What is the CVSS score of CVE-2026-33686?

CVE-2026-33686 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-33686?

A high-severity vulnerability in the code16/sharp PHP package enables authenticated attackers to write files outside designated directories, potentially overwriting critical configuration files like…. A patch is available.

How to fix or mitigate CVE-2026-33686?

Within 24 hours: Inventory all systems running code16/sharp and assess exposure scope; notify affected teams and prepare patching schedule. Within 7 days: Deploy vendor patch (PR #715) to all affected production and non-production environments; verify patch installation through version confirmation. Within 30 days: Conduct post-patch security validation; review access logs for exploitation attempts; implement file upload policy restrictions as defense-in-depth.

PHP CVE-2026-33686

HIGH

Path Traversal (CWE-22)

2026-03-25 https://github.com/code16/sharp

Path Traversal PHP

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 25, 2026 - 20:02 vuln.today

Patch released

Mar 25, 2026 - 20:02 nvd

Patch available

CVE Published

Mar 25, 2026 - 20:01 nvd

HIGH 8.8

DescriptionGitHub Advisory

Summary

A path traversal vulnerability exists in the FileUtil class of the code16/sharp package. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer.

Detail

In src/Utils/FileUtil.php, the FileUtil::explodeExtension() function extracts a file's extension by splitting the filename at the last dot. However, the extracted extension is never sanitized. While the application uses a normalizeName() function, this function only cleans the base filename, meaning any path separators (such as /) injected into the extension will survive and be passed into the storeAs() function.

Impact

Exploiting this flaw allows an authenticated attacker to manipulate file paths:

Files can be written outside of the intended tmp directory via path traversal. For more details on the package, visit: https://github.com/code16/sharp
Existing critical files (such as .env or configuration files) could potentially be overwritten. Review the CWE definition here: https://cwe.mitre.org/data/definitions/22.html (Note: This vulnerability was successfully chained with CWE-434 in a local Proof of Concept to confirm the traversal.)

Patches

This issue has been patched by properly sanitizing the extension using pathinfo(PATHINFO_EXTENSION) instead of strrpos(), alongside applying strict regex replacements to both the base name and the extension. The fix is available in pull request #715

Credits

Reported by zaurgsynv.

AnalysisAI

Authenticated attackers can bypass file path restrictions in PHP's code16/sharp package by injecting path separators into file extensions, enabling arbitrary file writes outside intended directories. The vulnerability stems from incomplete input sanitization in the FileUtil class where extensions are extracted but never validated before being passed to storage functions. A patch is available to address this high-severity path traversal issue affecting all users of the vulnerable package.

Technical ContextAI

The vulnerability affects code16/sharp, a PHP-based content management framework distributed as a Composer package (pkg:composer/code16_sharp). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The FileUtil::explodeExtension() function in src/Utils/FileUtil.php extracts file extensions using strrpos() to split at the last dot, but never sanitizes the extracted extension. While the application applies normalizeName() to clean the base filename, path separators (such as forward slashes) embedded in the extension component bypass sanitization and are passed directly to Laravel's storeAs() function. This allows directory traversal sequences to escape the intended storage directory. The patch replaces strrpos() with pathinfo(PATHINFO_EXTENSION) and applies strict regex validation to both filename components.

RemediationAI

Update the code16/sharp package to the patched version incorporating the fixes from pull request #715 available at https://github.com/code16/sharp/pull/715. Consult the vendor security advisory at https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958 for the specific patched version number and upgrade instructions via Composer. Until patching is complete, implement compensating controls such as restricting file upload functionality to highly trusted administrators only, implementing additional server-side validation of uploaded filenames and extensions, applying strict filesystem permissions to prevent overwriting critical files, and monitoring file system activity for suspicious write operations outside expected directories. Organizations should also review existing uploaded files for evidence of exploitation attempts.