« Volver al listado

CVE-2026-33686

Estado: AnalizadaAlta (8.8)—

Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Path traversal en servicio remoto (CWE-22) con acceso autenticado (PR:L) permite lectura y manipulación de datos en el almacenamiento del servidor Laravel mediante extensiones mal sanitizadas.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramNetwork SegmentationApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability Scanning

Tecnologías afectadas (1)

Code16 — Sharp

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-33686",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33686",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-27T13:59:38.470602Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "code16",
          "product": "sharp",
          "versions": [
            {
              "status": "affected",
              "version": "< 9.20.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-26T22:16:31.050",
  "references": [
    {
      "url": "https://github.com/code16/sharp/pull/715",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability  in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer. In `src/Utils/FileUtil.php`, the `FileUtil::explodeExtension()` function extracts a file's extension by splitting the filename at the last dot. This issue has been patched in version 9.20.0 by properly sanitizing the extension using `pathinfo(PATHINFO_EXTENSION)` instead of `strrpos()`, alongside applying strict regex replacements to both the base name and the extension."
    },
    {
      "lang": "es",
      "value": "Sharp es un framework de gestión de contenido construido para Laravel como un paquete. Las versiones anteriores a la 9.20.0 tienen una vulnerabilidad de salto de ruta en la clase FileUtil. La aplicación no sanitiza las extensiones de archivo correctamente, permitiendo que los separadores de ruta se pasen a la capa de almacenamiento. En 'src/Utils/FileUtil.php', la función 'FileUtil::explodeExtension()' extrae la extensión de un archivo dividiendo el nombre del archivo en el último punto. Este problema ha sido parcheado en la versión 9.20.0 sanitizando correctamente la extensión usando 'pathinfo(PATHINFO_EXTENSION)' en lugar de 'strrpos()', junto con la aplicación de reemplazos de expresiones regulares estrictos tanto al nombre base como a la extensión."
    }
  ],
  "lastModified": "2026-06-17T10:37:55.513",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:code16:sharp:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D710527-04D5-4152-A28C-506356B95CE1",
              "versionEndExcluding": "9.20.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}