Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-26 | 2 | Disclosure1Patch1 |
| 2026-03-27 | 1 | Disclosure1 |
CVE-2026-33686 Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The appli… https://www.cve.org/CVERecord?id=CVE-2026-33686
Post summary
The text announces a path traversal bug in Sharp CMS before v9.20.0, without mentioning any PoC, exploit, patch, or active exploitation.
[CVE-2026-33686: HIGH] Vulnerability alert: Sharp for Laravel versions prior to 9.20.0 are prone to path traversal due to improper file extension sanitization. Upgrade to 9.20.0 to patch this issue.#cve,CVE-2026-33686,#cybersecurity https://cvefind.com/CVE-2026-33686
Post summary
A path traversal vulnerability in Laravel Sharp before 9.20.0 has been reported; users should upgrade to 9.20.0 to mitigate the issue.
🟠 CVE-2026-33686 - High Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize ... https://www.thehackerwire.com/vulnerability/CVE-2026-33686/ https://t.co/cbuMBqpXIl
Post summary
The tweet announces the discovery of a path traversal flaw, CVE‑2026‑33686, in Sharp CMS (Laravel package) affecting versions before 9.20.0.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | code16 | sharp | - | - | - |