CVE-2026-44692 Details
Description
Sharp is a content management framework built for Laravel as a package. Prior to version 9.22.0, Sharp exposes a generic download endpoint that authorizes access only to the supplied Sharp entity instance, but then reads the target storage disk and path from request parameters. Because the requested storage object is not bound to the authorized entity instance, an authenticated Sharp user who can view one valid record may use that record as an authorization anchor to download unrelated disk-relative objects from configured Laravel Storage disks. The confirmed impact is authenticated disclosure of unrelated objects from configured Laravel Storage disks. This issue does not imply arbitrary host filesystem access outside configured Laravel Storage disk roots. This issue has been patched in version 9.22.0.
A vulnerability in Code16 Sharp prior to version 9.22.0 allows authenticated users to download unrelated files from Laravel Storage disks. The issue arises because the generic download endpoint authorizes access based only on the specified Sharp entity instance, while the target storage disk and path are determined by request parameters. This lack of binding between the storage object and the authorized entity instance enables users to exploit the endpoint by downloading arbitrary disk-relative objects, such as exports, backups, invoices, or other sensitive files, from configured Laravel Storage disks. The vulnerability does not grant access to the host filesystem outside of the Laravel Storage disk roots.
Users are advised to upgrade to Code16 Sharp version 9.22.0 or later. If an immediate upgrade is not possible, applications should restrict the 'downloads.allowed_disks' setting to the minimum necessary for Sharp downloads, avoid placing sensitive files on disks accessible through Sharp's download endpoint, and implement application-level controls to ensure requested files are linked to the authorized record.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 10, 2026CISA-ADP
Assessed Jun 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/code16/sharp/releases/tag/v9.22.0 | [email protected] | Release NotesVendor |
| https://github.com/code16/sharp/security/advisories/GHSA-748w-hm6r-qc7v | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| code16/sharp | < 9.22.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |