Path Traversal Vulnerability in Sharp Content Management Framework by Code16
CVE-2026-33686

8.8HIGH

Key Information:

Vendor

Code16

Status
Sharp
Vendor
CVE Published:
26 March 2026

What is CVE-2026-33686?

The Sharp content management framework, developed by Code16, suffers from a path traversal vulnerability in versions prior to 9.20.0. This vulnerability lies in the FileUtil class, where the application improperly sanitizes file extensions, permitting malicious actors to exploit path separators within the storage layer. The flaw is located in the src/Utils/FileUtil.php file, specifically in the FileUtil::explodeExtension() function, which attempts to extract a file's extension by dividing the filename at the last dot. However, without proper sanitation, attackers can manipulate this functionality. The issue has been addressed in version 9.20.0, which implements enhanced sanitation measures using pathinfo(PATHINFO_EXTENSION) and strict regex replacements for file name and extension handling.

Affected Version(s)

sharp < 9.20.0

References

https://github.com/code16/sharp/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/code16/sharp/pull/715
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.