Impact Analysis

This vulnerability can have severe impacts as indicated by its CVSS score of 8.8. An attacker with low privileges can exploit the path traversal flaw to access or modify files outside the intended storage directories. This can lead to full compromise of confidentiality, integrity, and availability of the affected system, potentially allowing unauthorized access to sensitive data, modification of files, or disruption of services.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Sharp to version 9.20.0 or later, where the path traversal issue in the FileUtil class has been patched.

The patch involves proper sanitization of file extensions using pathinfo(PATHINFO_EXTENSION) instead of strrpos(), and applying strict regex replacements to both the base name and the extension.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Sharp content management framework for Laravel, specifically in versions prior to 9.20.0. It is a path traversal vulnerability found in the FileUtil class. The issue arises because the application does not properly sanitize file extensions, allowing path separators to be passed into the storage layer. The vulnerable function, FileUtil::explodeExtension(), extracts a file's extension by splitting the filename at the last dot, which can be exploited. The vulnerability was fixed in version 9.20.0 by using a safer method to extract the extension and applying strict regex sanitization.

Useful 0 Not Useful 0