CVE-2026-44692: Sharp Laravel Package Authenticated Path Traversal and Unauthorized File Disclosure

Technical summary

Sharp's generic download endpoint validates that an authenticated user can access a specific Sharp entity instance, but fails to bind the requested storage disk and path to that authorized entity. The authorization check examines the entity instance only; the subsequent storage lookup accepts disk and path parameters directly from the request without validating that those resources belong to the authorized entity. This is a classic authorization bypass where the authentication anchor (the entity) is disconnected from the resource being accessed (arbitrary storage objects). The vulnerability is scoped to configured Laravel Storage disk roots and does not permit filesystem access outside those boundaries.

Business impact

Organizations deploying Sharp for content management face potential exposure of sensitive files stored on configured Laravel Storage disks—such as user data, documents, configuration artifacts, or other application assets. An attacker with any valid Sharp user account (including lower-privileged users) can enumerate and download files not intended for their access, leading to unauthorized information disclosure. This is particularly concerning in multi-tenant or role-separated environments where different users should only access their own data. The risk is heightened if backup files, logs, or other sensitive artifacts are stored on the same Laravel Storage disks as application data.

Affected systems

The vulnerability affects Sharp versions prior to 9.22.0. Any Laravel application using Sharp for its administrative or content management interface is at risk if running an affected version. The scope is limited to environments where one or more authenticated Sharp users have access to at least one valid record; the attacker does not need to be an administrator.

Exploitability

Exploitability is straightforward for an authenticated attacker. The vulnerability requires valid Sharp credentials and knowledge of or ability to discover storage disk names and file paths. An attacker can perform requests directly to the download endpoint, specifying arbitrary storage disks and paths while using their valid authentication. No special network access, user interaction, or complex attack chains are required. The main friction is discovering which files exist on the configured storage disks, though this can be inferred from error messages, application behavior, or reconnaissance.

Remediation

Upgrade Sharp to version 9.22.0 or later. The patch binds the requested storage resource to the authorized entity instance, ensuring that only files associated with an entity that the user is authorized to access can be downloaded. No workarounds are available for earlier versions; upgrading is the definitive fix.

Patch guidance

Review your Laravel application's composer.json or lock file to identify the current Sharp version. If the version is earlier than 9.22.0, update the package via composer. Test the upgrade in a non-production environment first to verify compatibility with your Sharp configuration and custom implementations. After deployment, verify that file downloads through Sharp's UI continue to function as expected and that unauthorized file access is no longer possible.

Detection guidance

Monitor Sharp download endpoint requests for suspicious patterns: requests to the download endpoint originating from users attempting to access storage paths outside their expected data scope, repeated requests with varying disk or path parameters, or downloads of system or configuration files. Log all download endpoint accesses and cross-reference them against which entities and users initiated them. If your application logs Laravel Storage disk access, correlate those logs with Sharp authentication sessions to identify unauthorized file retrievals. Look for error messages in application logs indicating invalid or unexpected path references.

Why prioritize this

This vulnerability rates HIGH (CVSS 7.7) and should be prioritized for immediate patching because it enables authenticated users to exfiltrate confidential data from shared storage infrastructure. The low attack complexity and lack of user interaction required, combined with high confidentiality impact and cross-boundary data access (S:C), make this a significant risk even though it requires valid credentials. Organizations should prioritize this upgrade within their standard critical-patch timelines.

Risk score, explained

The CVSS 7.7 score reflects a HIGH-severity vulnerability: network-accessible, low attack complexity, requires low privilege (authenticated user status), no user interaction needed, and causes complete confidentiality compromise. The scope is changed (S:C) because the attacker can access resources beyond their authorized entity boundary. Integrity and availability are not impacted. The high score is justified given that any authenticated Sharp user—not just administrators—can trigger the vulnerability.

Frequently asked questions