CVE-2026-33686 Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil
Attackers can exploit unsanitized file extensions in Sharp to perform path traversal, potentially reading or modifying files outside the intended storage directory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33686?
CVE-2026-33686 is a high-severity path traversal vulnerability in code16 sharp, published on 26 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.
Weakness: CWE-22
Which versions are affected by CVE-2026-33686?
2 open source packages ship an affected version, including code16/sharp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
code16/sharp Packagist | All versions | 9.20.0 |
code16/sharp Packagist | All versions | 9.20.0 |
Products include Code16 Sharp.
How do I fix CVE-2026-33686?
Upgrade code16/sharp to 9.20.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-33686 being exploited?
There is no known exploitation of CVE-2026-33686 in the wild and no public exploit code.
Other vulnerabilities in code16 sharp
Sources
Also known as GHSA-9ffq-6457-8958.