Sharp vulnerabilities

Several vulnerabilities have been discovered and fixed in the upstream libvips dependency, two rated as high severity using CVSSv4. Versions of sharp prior to 0.35.0 processing untrusted input are affected.

Sharp, a Laravel content management framework, from version 9.0.0 to before 9.22.3 does not enforce authorization checks on the create and store endpoints of the Quick Creation Command feature. An authenticated Sharp user without create permission on a given entity can bypass authorization and create new records for that entity if a Quick Creation Command handler is configured.

Sharp, a CMS framework for Laravel, prior to version 9.22.0 exposes a generic download endpoint that authorizes access only to the entity instance but reads the target disk and path from request parameters. An authenticated Sharp user who can view one valid record may use it as an authorization anchor to download unrelated objects from Laravel Storage disks.