If you discover any security related issues, please email security@code16.fr instead of using the issue tracker.
Repository navigation
Security: code16/sharp
Security
SECURITY.md
-
Arbitrary file path persisted through upload field values, allowing arbitrary file read via thumbnails and downloads (CWE-73 / CWE-22)GHSA-4qrp-9h7g-2ppj published
Oct 5, 2026 by aguingandHigh -
Stored XSS via editor embed slot and sanitizer marker bypassGHSA-rvwr-v9r9-85m5 published
Oct 5, 2026 by aguingandCritical -
Arbitrary File Read via Upload Thumbnail Endpoint (CWE-552 / CWE-22)GHSA-3hg9-hhvr-c4pf published
Oct 5, 2026 by aguingandHigh -
Entity list reorder endpoint does not enforce the reorder policyGHSA-764r-886w-vjc3 published
Sep 28, 2026 by dvlppModerate -
IDOR: Any authenticated user can view and rename another user's passkeyGHSA-q59m-h439-74rj published
Sep 28, 2026 by dvlppHigh -
SSRF via Unanchored Autocomplete Endpoint CheckGHSA-g6f8-c3x9-jv7f published
Jul 17, 2026 by aguingandHigh -
Missing authorization check across multiple API endpointsGHSA-w958-q64c-xfcj published
Jul 17, 2026 by aguingandModerate -
Arbitrary Class Instantiation via an API parameterGHSA-h24v-f482-8cwf published
Jul 17, 2026 by aguingandModerate -
Stored XSS via iframe srcdoc AttributeGHSA-qxg3-46rw-79j8 published
Jun 24, 2026 by aguingandHigh -
Stored XSS via data-html-content Sanitizer BypassGHSA-vj3q-vp3g-j9c8 published
Jun 24, 2026 by aguingandHigh
Learn more about advisories related to code16/sharp in the GitHub Advisory Database