CVE-2026-33687

CVE-2026-33687 describes an unrestricted file upload vulnerability in Sharp, a Laravel content management framework, affecting versions prior to 9.20.0. Authenticated users can bypass file type restrictions by manipulating a client-controlled validation parameter in the upload endpoint. This vulnerability carries a CVSSv3.1 score of 8.8 (High), indicating it is easily exploitable over the network with low privileges and no user interaction, potentially leading to high impact on confidentiality, integrity, and availability. Successful exploitation could allow attackers to upload malicious files, though direct execution of uploaded PHP files typically requires a public storage disk configuration; a recommended workaround is to ensure private storage. There is currently no evidence of active exploitation, nor are public exploit codes available, though the vulnerability has garnered limited community discussion.