A path traversal vulnerability in the Sharp content management framework for Laravel, identified as CVE-2026-33686, allows authenticated attackers to potentially compromise system files.

The vulnerability exists in the FileUtil::explodeExtension() function within src/Utils/FileUtil.php, where improper sanitization of file extensions allows path separators to be injected into the storage layer. The flaw requires the attacker to have low privileges (authenticated access) to trigger the malicious input.

Successful exploitation of this path traversal vulnerability could lead to unauthorized file access, modification, or deletion within the application storage environment. Given the high CVSS score of 8.8, this flaw poses a significant risk to data integrity and system availability, potentially enabling an attacker to achieve full control over the application's file handling processes.

Immediate Action: Update the Code16 Sharp package to version 9.20.0 or later to ensure the proper implementation of path sanitization via pathinfo(PATHINFO_EXTENSION).

Proactive Monitoring: Review application logs for unusual file upload activity or attempts to access unexpected directory paths within the storage layer.

Compensating Controls: Implement strict file validation and sanitization routines at the application level, and ensure that the web server process runs with the least privilege necessary to limit the impact of potential directory escapes.

Public Exploit Available: No.

The severity of this vulnerability, combined with the potential for total impact on the affected system, necessitates immediate action. Administrators should verify their current Sharp version and apply the 9.20.0 update immediately to mitigate the risk of unauthorized file system access or manipulation.