CVE-2026-33686
Path Traversal in Sharp CMS FileUtil Allows Arbitrary File Access
Publication date: 2026-03-26
Last updated on: 2026-04-01
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| code16 | sharp | to 9.20.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Sharp content management framework for Laravel, specifically in versions prior to 9.20.0. It is a path traversal vulnerability found in the FileUtil class. The issue arises because the application does not properly sanitize file extensions, allowing path separators to be passed into the storage layer. The vulnerable function, FileUtil::explodeExtension(), extracts a file's extension by splitting the filename at the last dot, which can be exploited. The vulnerability was fixed in version 9.20.0 by using a safer method to extract the extension and applying strict regex sanitization.
How can this vulnerability impact me? :
This vulnerability can have severe impacts as indicated by its CVSS score of 8.8. An attacker with low privileges can exploit the path traversal flaw to access or modify files outside the intended storage directories. This can lead to full compromise of confidentiality, integrity, and availability of the affected system, potentially allowing unauthorized access to sensitive data, modification of files, or disruption of services.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Sharp to version 9.20.0 or later, where the path traversal issue in the FileUtil class has been patched.
The patch involves proper sanitization of file extensions using pathinfo(PATHINFO_EXTENSION) instead of strrpos(), and applying strict regex replacements to both the base name and the extension.