{"id":"CVE-2026-33686","aliases":["EUVD-2026-16446","GHSA-9ffq-6457-8958"],"status":"published","title":"Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil","description":"Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability  in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00557,"percentile":0.46775,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-03-25T20:01:04Z","modified":"2026-10-28T02:30:29Z","fixes":[{"ecosystem":"Packagist","package":"code16/sharp","fixed_in":["9.20.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"code16/sharp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"code16/sharp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20.0"}]}],"versions":["7.0.0-alpha.1","7.27.0","7.7.2","v4.0-BETA1","v4.0-BETA2","v4.0-BETA3","v4.0-BETA4","v4.0-BETA5","v4.0-BETA6","v4.0.0","v4.0.1","v4.0.10","v4.0.11","v4.0.12","v4.0.13","v4.0.14","v4.0.15","v4.0.16","v4.0.17","v4.0.18","v4.0.19","v4.0.2","v4.0.20","v4.0.21","v4.0.3","v4.0.4","v4.0.5","v4.0.6","v4.0.7","v4.0.8","v4.0.9","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.13","v4.1.14","v4.1.15","v4.1.16","v4.1.17","v4.1.18","v4.1.19","v4.1.2","v4.1.20","v4.1.21","v4.1.22","v4.1.23","v4.1.24","v4.1.25","v4.1.3","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.2.0","v4.2.1","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v5.0.0","v5.0.0-alpha.1","v5.0.0-alpha.10","v5.0.0-alpha.2","v5.0.0-alpha.3","v5.0.0-alpha.4","v5.0.0-alpha.5","v5.0.0-alpha.6","v5.0.0-alpha.7","v5.0.0-alpha.8","v5.0.0-alpha.9","v5.0.1","v5.1.0","v5.1.1","v5.1.2","v5.2.0","v5.3.0","v5.3.1","v5.3.2","v5.3.3","v5.3.4","v5.3.5","v5.4.0","v5.4.1","v5.4.2","v5.4.3","v5.4.4","v5.4.5","v5.4.6","v6.0.0","v6.0.0-alpha.1","v6.0.0-alpha.2","v6.0.0-alpha.3","v6.0.0-alpha.4","v6.0.0-alpha.5","v6.0.0-alpha.6","v6.0.0-alpha.7","v6.0.0-beta.1","v6.0.0-beta.2","v6.0.0-beta.3","v6.0.1","v6.1.0","v6.1.1","v6.1.2","v6.1.3","v6.1.4","v6.1.5","v6.2.0","v6.3.0","v6.3.1","v6.3.2","v6.3.3","v6.4.0","v6.4.1","v6.5.0","v6.5.1","v6.5.2","v6.5.3","v6.5.4","v6.5.5","v7.0.0","v7.0.0-beta.1","v7.0.0-beta.2","v7.0.0-beta.3","v7.0.0-beta.4","v7.0.0-beta.5","v7.0.0-beta.6","v7.0.1","v7.0.2","v7.1.0","v7.10.0","v7.11.0","v7.12.0","v7.13.0","v7.14.0","v7.15.0","v7.16.0","v7.17.0","v7.17.1","v7.17.2","v7.17.3","v7.18.0","v7.19.0","v7.19.1","v7.2.0","v7.2.1","v7.2.2","v7.2.3","v7.2.4","v7.2.5","v7.20.0","v7.21.0","v7.22.0","v7.23.0","v7.23.1","v7.23.2","v7.24.0","v7.24.1","v7.25.0","v7.25.1","v7.25.2","v7.26.0","v7.26.1","v7.26.2","v7.27.1","v7.28.0","v7.29.0","v7.29.1","v7.29.2","v7.29.3","v7.29.4","v7.29.5","v7.29.6","v7.29.7","v7.3.0","v7.30.0","v7.4.0","v7.5.0","v7.5.1","v7.5.2","v7.6.0","v7.7.0","v7.7.1","v7.8.0","v7.9.0","v8.0.0","v8.0.1","v8.0.2","v8.0.3","v8.0.4","v8.0.5","v8.0.6","v8.0.7","v8.1.0","v8.1.1","v8.1.2","v8.2.0","v8.2.1","v8.3.0","v8.3.1","v8.3.2","v8.3.3","v8.3.4","v8.3.5","v8.3.6","v8.3.7","v8.4.0","v8.4.1","v8.4.2","v8.4.3","v8.4.4","v8.5.0","v8.6.0","v8.6.1","v9.0.0","v9.0.0-alpha.1","v9.0.0-alpha.2","v9.0.0-beta.1","v9.0.0-beta.10","v9.0.0-beta.11","v9.0.0-beta.12","v9.0.0-beta.13","v9.0.0-beta.14","v9.0.0-beta.15","v9.0.0-beta.16","v9.0.0-beta.17","v9.0.0-beta.2","v9.0.0-beta.3","v9.0.0-beta.4","v9.0.0-beta.5","v9.0.0-beta.6","v9.0.0-beta.7","v9.0.0-beta.8","v9.0.0-beta.9","v9.0.1","v9.0.2","v9.0.3","v9.0.4","v9.0.5","v9.0.6","v9.0.7","v9.0.8","v9.0.9","v9.1.0","v9.1.1","v9.1.2","v9.10.0","v9.10.1","v9.10.2","v9.11.0","v9.11.1","v9.12.0","v9.13.0","v9.13.1","v9.14.0","v9.14.1","v9.14.2","v9.14.3","v9.14.4","v9.15.0","v9.15.1","v9.16.0","v9.16.1","v9.17.0","v9.17.1","v9.18.0","v9.19.0","v9.19.1","v9.19.2","v9.19.3","v9.2.0","v9.2.1","v9.2.2","v9.2.3","v9.2.4","v9.2.5","v9.2.6","v9.2.7","v9.2.8","v9.3.0","v9.3.1","v9.3.2","v9.3.3","v9.3.4","v9.3.5","v9.3.6","v9.3.7","v9.4.0","v9.4.1","v9.5.0","v9.5.1","v9.5.2","v9.6.0","v9.6.1","v9.6.2","v9.6.3","v9.6.4","v9.6.5","v9.6.6","v9.7.0","v9.7.1","v9.7.2","v9.7.3","v9.8.0","v9.8.1","v9.9.0"]}],"products":[{"vendor":"code16","product":"sharp"}],"references":[{"url":"https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/code16/sharp/pull/715","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33686","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9ffq-6457-8958"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33686.json","tags":["advisory"]},{"url":"https://github.com/code16/sharp","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-33686","title":"Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil","description":"Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability  in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.","status":"published","published":"2026-03-26T21:54:25.294Z","modified":"2026-03-27T13:59:50.752Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:08.009733Z"}],"euvd":[{"id":"EUVD-2026-16446","description":"Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability  in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.","status":"published","published":"2026-03-26T21:54:25Z","modified":"2026-03-27T13:59:50Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:25:27.277964Z"}],"ghsa":[{"id":"GHSA-9ffq-6457-8958","title":"Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil","description":"### Summary\nA path traversal vulnerability exists in the FileUtil class of the code16/sharp package. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer.\n\n### Detail\nIn `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. However, the extracted extension is never sanitized. While the application uses a `normalizeName()` function, this function only cleans the base filename, meaning any path separators (such as /) injected into the extension will survive and be passed into the `storeAs()` function.\n\n### Impact\nExploiting this flaw allows an authenticated attacker to manipulate file paths:\n- Files can be written outside of the intended tmp directory via path traversal. For more details on the package, visit: https://github.com/code16/sharp\n- Existing critical files (such as .env or configuration files) could potentially be overwritten. Review the CWE definition here: https://cwe.mitre.org/data/definitions/22.html (Note: This vulnerability was successfully chained with CWE-434 in a local Proof of Concept to confirm the traversal.)\n\n### Patches\nThis issue has been patched by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension. The fix is available in pull request #715\n\n### Credits\nReported by [zaurgsynv](https://github.com/zaurgsynv).","status":"published","published":"2026-03-25T20:01:04Z","modified":"2026-03-27T21:36:05Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:43.747579Z"}],"nvd":[{"id":"CVE-2026-33686","description":"Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability  in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.","status":"published","published":"2026-03-26T22:16:31.05Z","modified":"2026-06-17T10:37:55.513Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"CVE-2026-33686","title":"Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil","description":"Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability  in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.","status":"published","published":"2026-03-26T21:54:25.294Z","modified":"2026-10-28T02:30:29.176808694Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:01.896044Z"},{"id":"GHSA-9ffq-6457-8958","title":"Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil","description":"### Summary\nA path traversal vulnerability exists in the FileUtil class of the code16/sharp package. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer.\n\n### Detail\nIn `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. However, the extracted extension is never sanitized. While the application uses a `normalizeName()` function, this function only cleans the base filename, meaning any path separators (such as /) injected into the extension will survive and be passed into the `storeAs()` function.\n\n### Impact\nExploiting this flaw allows an authenticated attacker to manipulate file paths:\n- Files can be written outside of the intended tmp directory via path traversal. For more details on the package, visit: https://github.com/code16/sharp\n- Existing critical files (such as .env or configuration files) could potentially be overwritten. Review the CWE definition here: https://cwe.mitre.org/data/definitions/22.html (Note: This vulnerability was successfully chained with CWE-434 in a local Proof of Concept to confirm the traversal.)\n\n### Patches\nThis issue has been patched by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension. The fix is available in pull request #715\n\n### Credits\nReported by [zaurgsynv](https://github.com/zaurgsynv).","status":"published","published":"2026-03-25T20:01:04Z","modified":"2026-03-27T21:49:58.767095Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:43.524801Z"}]}}