CVE-2026-33686 Details
Description
Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.
A path traversal vulnerability has been identified in the Code16 Sharp content management framework for Laravel, specifically in versions prior to 9.20.0. The issue arises in the FileUtil class, where the application improperly sanitizes file extensions. This flaw allows path separators to be injected and passed into the storage layer, potentially leading to unauthorized file manipulation. The vulnerability exists in the 'FileUtil::explodeExtension()' function, which extracts file extensions by splitting the filename at the last dot. However, the extracted extension is not adequately sanitized, enabling path traversal exploits.
Users can update to Code16 Sharp version 9.20.0 or later, where this vulnerability has been patched. The fix involves proper sanitization of file extensions using 'pathinfo(PATHINFO_EXTENSION)' instead of 'strrpos()', along with strict regex replacements for both the base name and the extension.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/code16/sharp/pull/715 | [email protected] | Issue TrackingPatch |
| https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| code16 sharp | < 9.20.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 1, 2026 | Initial Analysis | [email protected] |
| Mar 26, 2026 | New CVE Received | [email protected] |