CVE-2026-33686

CVE-2026-33686 is a high-severity path traversal vulnerability affecting Sharp, a content management framework for Laravel, in versions prior to 9.20.0. The flaw resides in the FileUtil class, where improper sanitization of file extensions allows path separators to be passed to the storage layer. Rated with a CVSS score of 8.8 (High), this vulnerability can be exploited remotely with low privileges and no user interaction, potentially leading to high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation, nor publicly available exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered some community discussion, indicating awareness among security researchers. Organizations using affected versions should upgrade to 9.20.0 or later to mitigate this risk.