CVE-2026-44692
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Sharp, a CMS framework for Laravel, prior to version 9.22.0 exposes a generic download endpoint that authorizes access only to the entity instance but reads the target disk and path from request parameters. An authenticated Sharp user who can view one valid record may use it as an authorization anchor to download unrelated objects from Laravel Storage disks.
Risk Assessment
The organization is at risk of disclosure of sensitive data stored on Laravel Storage disks by an authenticated user who should not have access to them.
Recommendation
Update Sharp to version 9.22.0 or later immediately.
Other vulnerabilities in Sharp
See all- GHSA-f88m-g3jw-g9cjHigh
Several vulnerabilities have been discovered and fixed in the upstream libvips dependency, two rated as high severity using CVSSv4. Versions of sharp prior to 0.35.0 processing untrusted input are affected.
- CVE-2026-53634Medium
Sharp, a Laravel content management framework, from version 9.0.0 to before 9.22.3 does not enforce authorization checks on the create and store endpoints of the Quick Creation Command feature. An authenticated Sharp user without create permission on a given entity can bypass authorization and create new records for that entity if a Quick Creation Command handler is configured.
Original NVD description (English source)
Sharp is a content management framework built for Laravel as a package. Prior to version 9.22.0, Sharp exposes a generic download endpoint that authorizes access only to the supplied Sharp entity instance, but then reads the target storage disk and path from request parameters. Because the requested storage object is not bound to the authorized entity instance, an authenticated Sharp user who can view one valid record may use that record as an authorization anchor to download unrelated disk-relative objects from configured Laravel Storage disks. The confirmed impact is authenticated disclosure of unrelated objects from configured Laravel Storage disks. This issue does not imply arbitrary host filesystem access outside configured Laravel Storage disk roots. This issue has been patched in version 9.22.0.