Vulnerability · Published Mar 26, 2026 · Assigned by GitHub_M
CVE-2026-33687Sharp has Unrestricted File Upload via Client-Controlled Validation Rules
High 8.8
In plain English
A high-severity unrestricted file upload in sharp from code16. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 contain a vulnerability in the file upload endpoint that allows authenticated users to bypass all file type restrictions. The upload endpoint within the `ApiFormUploadController` accepts a client-controlled `validation_rule` parameter. This parameter is directly passed into the Laravel validator without sufficient server-side enforcement. By intercepting the request and sending `validation_rule[]=file`, an attacker can completely bypass all MIME type and file extension restrictions. This issue has been addressed in version 9.20.0 by removing the client-controlled validation rules and strictly defining upload rules server-side. As a workaround, ensure that the storage disk used for Sharp uploads is strictly private. Under default configurations, an attacker cannot directly execute uploaded PHP files unless a public disk configuration is explicitly used.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | code16/sharp | 9.20.0 | GHSA-fr76-5637-w3g9 |
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/code16/sharp/security/advisories/GHSA-fr76-5637-w3g9 x_refsource_CONFIRM
- https://github.com/code16/sharp/pull/714 x_refsource_MISC
- https://github.com/code16/sharp/releases/tag/v9.20.0 x_refsource_MISC
- https://laravel.com/docs/13.x/filesystem x_refsource_MISC