CVE-2026-33686: falha de alta gravidade em code16 sharp
Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.6%
Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
code16 · sharpCVEs relacionadas — code16 sharp
No mesmo produto, das mais perigosas para as menos.
CVE-2026-33687HIGHSharp has Unrestricted File Upload via Client-Controlled Validation RulesEPSS 0.5%CVE-2026-44692HIGHAuthenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpointEPSS 0.3%CVE-2026-61825HIGHcode16/sharp has a stored XSS via data-html-content Sanitizer BypassEPSS 0.2%CVE-2025-62798MEDIUMSharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntaxEPSS 0.2%CVE-2026-53634MEDIUMSharp: Missing Authorization Check in Quick Creation Command EndpointsEPSS 0.2%CVE-2026-61823HIGHcode16 Sharp vulnerable to stored XSS via iframe srcdoc AttributeEPSS 0.2%