CVE-2026-33686
Sharp is a content management framework built for Laravel as a package.
Published Mar 26, 2026 · updated Jun 17, 2026 · code16 sharp
Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In , the function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using instead of , alongside applying strict regex replacements to both the base name and the extension.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 26, 2026 · NIST NVD
Detected
Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In , the function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in ve
Jun 17, 2026 · NIST NVD
Updated
Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In , the function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in ve
Affected
- cpe code16/sharpversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33686
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33686
Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. I
nvd.nist.gov