File Upload Vulnerability in Sharp Content Management Framework for Laravel

CVE-2026-33687

What is CVE-2026-33687?

The Sharp content management framework for Laravel has a vulnerability in its file upload system that allows authenticated users to bypass file type restrictions. The validation_rule parameter can be manipulated, enabling an attacker to upload files that may contain malicious content. This issue arises from insufficient server-side validation of the validation_rule parameter in the ApiFormUploadController, potentially leading to unauthorized file uploads. The vulnerability has been resolved in version 9.20.0, which enforces server-side controls for upload rules. To mitigate risks before updating, it is recommended that users ensure their storage configurations are set to private.

References