Vulnerability-Lookup

CVE-2026-33686 (GCVE-0-2026-33686)

Vulnerability from cvelistv5 – Published: 2026-03-26 21:54 – Updated: 2026-03-27 13:59

Title

Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil

Summary

Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/code16/sharp/security/advisori…	x_refsource_CONFIRM
	https://github.com/code16/sharp/pull/715	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	code16	sharp	Affected: < 9.20.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33686",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-27T13:59:38.470602Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-27T13:59:50.752Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sharp",
          "vendor": "code16",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.20.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability  in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file\u0027s extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-26T21:54:25.294Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958"
        },
        {
          "name": "https://github.com/code16/sharp/pull/715",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/code16/sharp/pull/715"
        }
      ],
      "source": {
        "advisory": "GHSA-9ffq-6457-8958",
        "discovery": "UNKNOWN"
      },
      "title": "Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33686",
    "datePublished": "2026-03-26T21:54:25.294Z",
    "dateReserved": "2026-03-23T16:34:59.931Z",
    "dateUpdated": "2026-03-27T13:59:50.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-33686\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-26T22:16:31.050\",\"lastModified\":\"2026-04-01T12:26:41.247\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability  in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file\u0027s extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.\"},{\"lang\":\"es\",\"value\":\"Sharp es un framework de gesti\u00f3n de contenido construido para Laravel como un paquete. Las versiones anteriores a la 9.20.0 tienen una vulnerabilidad de salto de ruta en la clase FileUtil. La aplicaci\u00f3n no sanitiza las extensiones de archivo correctamente, permitiendo que los separadores de ruta se pasen a la capa de almacenamiento. En \u0027src/Utils/FileUtil.php\u0027, la funci\u00f3n \u0027FileUtil::explodeExtension()\u0027 extrae la extensi\u00f3n de un archivo dividiendo el nombre del archivo en el \u00faltimo punto. Este problema ha sido parcheado en la versi\u00f3n 9.20.0 sanitizando correctamente la extensi\u00f3n usando \u0027pathinfo(PATHINFO_EXTENSION)\u0027 en lugar de \u0027strrpos()\u0027, junto con la aplicaci\u00f3n de reemplazos de expresiones regulares estrictos tanto al nombre base como a la extensi\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:code16:sharp:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"9.20.0\",\"matchCriteriaId\":\"0D710527-04D5-4152-A28C-506356B95CE1\"}]}]}],\"references\":[{\"url\":\"https://github.com/code16/sharp/pull/715\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-33686\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-27T13:59:38.470602Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-27T13:59:43.124Z\"}}], \"cna\": {\"title\": \"Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil\", \"source\": {\"advisory\": \"GHSA-9ffq-6457-8958\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"code16\", \"product\": \"sharp\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 9.20.0\"}]}], \"references\": [{\"url\": \"https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958\", \"name\": \"https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/code16/sharp/pull/715\", \"name\": \"https://github.com/code16/sharp/pull/715\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability  in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file\u0027s extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-26T21:54:25.294Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-33686\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-27T13:59:50.752Z\", \"dateReserved\": \"2026-03-23T16:34:59.931Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-26T21:54:25.294Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-9FFQ-6457-8958

Vulnerability from github – Published: 2026-03-25 20:01 – Updated: 2026-03-27 21:36

Summary

Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil

Details

Summary

A path traversal vulnerability exists in the FileUtil class of the code16/sharp package. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer.

Detail

In src/Utils/FileUtil.php, the FileUtil::explodeExtension() function extracts a file's extension by splitting the filename at the last dot. However, the extracted extension is never sanitized. While the application uses a normalizeName() function, this function only cleans the base filename, meaning any path separators (such as /) injected into the extension will survive and be passed into the storeAs() function.

Impact

Exploiting this flaw allows an authenticated attacker to manipulate file paths: - Files can be written outside of the intended tmp directory via path traversal. For more details on the package, visit: https://github.com/code16/sharp - Existing critical files (such as .env or configuration files) could potentially be overwritten. Review the CWE definition here: https://cwe.mitre.org/data/definitions/22.html (Note: This vulnerability was successfully chained with CWE-434 in a local Proof of Concept to confirm the traversal.)

Patches

This issue has been patched by properly sanitizing the extension using pathinfo(PATHINFO_EXTENSION) instead of strrpos(), alongside applying strict regex replacements to both the base name and the extension. The fix is available in pull request #715

Credits

Reported by zaurgsynv.

Severity ?

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "code16/sharp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.20.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33686"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-25T20:01:04Z",
    "nvd_published_at": "2026-03-26T22:16:31Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nA path traversal vulnerability exists in the FileUtil class of the code16/sharp package. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer.\n\n### Detail\nIn `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file\u0027s extension by splitting the filename at the last dot. However, the extracted extension is never sanitized. While the application uses a `normalizeName()` function, this function only cleans the base filename, meaning any path separators (such as /) injected into the extension will survive and be passed into the `storeAs()` function.\n\n### Impact\nExploiting this flaw allows an authenticated attacker to manipulate file paths:\n- Files can be written outside of the intended tmp directory via path traversal. For more details on the package, visit: https://github.com/code16/sharp\n- Existing critical files (such as .env or configuration files) could potentially be overwritten. Review the CWE definition here: https://cwe.mitre.org/data/definitions/22.html (Note: This vulnerability was successfully chained with CWE-434 in a local Proof of Concept to confirm the traversal.)\n\n### Patches\nThis issue has been patched by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension. The fix is available in pull request #715\n\n### Credits\nReported by [zaurgsynv](https://github.com/zaurgsynv).",
  "id": "GHSA-9ffq-6457-8958",
  "modified": "2026-03-27T21:36:04Z",
  "published": "2026-03-25T20:01:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33686"
    },
    {
      "type": "WEB",
      "url": "https://github.com/code16/sharp/pull/715"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/code16/sharp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil"
}

FKIE_CVE-2026-33686

Vulnerability from fkie_nvd - Published: 2026-03-26 22:16 - Updated: 2026-04-01 12:26

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/code16/sharp/pull/715	Issue Tracking, Patch
	security-advisories@github.com	https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958	Vendor Advisory

Impacted products

	Vendor	Product	Version
	code16	sharp	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:code16:sharp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D710527-04D5-4152-A28C-506356B95CE1",
              "versionEndExcluding": "9.20.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability  in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file\u0027s extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension."
    },
    {
      "lang": "es",
      "value": "Sharp es un framework de gesti\u00f3n de contenido construido para Laravel como un paquete. Las versiones anteriores a la 9.20.0 tienen una vulnerabilidad de salto de ruta en la clase FileUtil. La aplicaci\u00f3n no sanitiza las extensiones de archivo correctamente, permitiendo que los separadores de ruta se pasen a la capa de almacenamiento. En \u0027src/Utils/FileUtil.php\u0027, la funci\u00f3n \u0027FileUtil::explodeExtension()\u0027 extrae la extensi\u00f3n de un archivo dividiendo el nombre del archivo en el \u00faltimo punto. Este problema ha sido parcheado en la versi\u00f3n 9.20.0 sanitizando correctamente la extensi\u00f3n usando \u0027pathinfo(PATHINFO_EXTENSION)\u0027 en lugar de \u0027strrpos()\u0027, junto con la aplicaci\u00f3n de reemplazos de expresiones regulares estrictos tanto al nombre base como a la extensi\u00f3n."
    }
  ],
  "id": "CVE-2026-33686",
  "lastModified": "2026-04-01T12:26:41.247",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-26T22:16:31.050",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/code16/sharp/pull/715"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-33686 (GCVE-0-2026-33686)

GHSA-9FFQ-6457-8958

Summary

Detail

Impact

Patches

Credits

FKIE_CVE-2026-33686

Tags

Sightings

Nomenclature