CVE-2026-33687·PHP vulnerability
Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 contain a vulnerability in the file upload endpoint that allows authenticated users to bypass all file type restrictions. The upload endpoint within the `ApiFormUploadController` accepts a client-controlled `validation_rule` parameter. This parameter is directly passed into the Laravel validator without sufficient server-side enforcement. By intercepting the request and sending `validation_rule[]=file`, an attacker can completely bypass all MIME type and file extension restrictions. This issue has been addressed in version 9.20.0 by removing the client-controlled validation rules and strictly defining upload rules server-side. As a workaround, ensure that the storage disk used for Sharp uploads is strictly private. Under default configurations, an attacker cannot directly execute uploaded PHP files unless a public disk configuration is explicitly used.
- Severity
- high
- Software
- PHP
- Fixed in
- 9.20.0
- Published
- 2026-03-26
Affected versions
Until: 9.20.0
Fixed in: 9.20.0
How to fix this CVE
Update the Sharp package to version 9.20.0 or later, which removes client-controlled validation parameters and enforces file upload rules server-side. If an immediate update is not possible, ensure that the storage disk configured for Sharp uploads is set to private access only to prevent direct execution of uploaded files. Verify that your Laravel filesystem configuration does not expose the Sharp upload directory via a public disk.
sudo dnf update php php-common php-cli php-fpmDefensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
POST /sharp/api/.*/upload HTTP/1.1.*validation_rule\[\]=file|POST /sharp/api/.*/upload.*validation_rule.*php|POST.*upload.*Content-Disposition.*validation_ruleWAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
Implement WAF rules to block POST requests to Sharp upload endpoints (*/sharp/api/*/upload) that contain the parameter validation_rule in the request body or query string. Restrict file uploads to authenticated sessions only and validate Content-Type headers server-side without accepting client-controlled validation parameters.How to check if you are affected
- Step 1: Check your Sharp package version by running composer show code16/sharp in your Laravel project root directory.
- Step 2: Verify the Laravel filesystem configuration in config/filesystems.php and confirm that the Sharp upload disk is not set to 'public' visibility.
- Step 3: Search your web server access logs for POST requests to /sharp/api/*/upload with suspicious validation_rule parameters: grep -i 'validation_rule' /var/log/nginx/access.log or /var/log/apache2/access.log
- Step 4: Run composer update code16/sharp and verify the installed version is 9.20.0 or higher by checking composer.lock or running composer show code16/sharp again.
FAQ
What is CVE-2026-33687?
CVE-2026-33687 is a file upload validation bypass vulnerability in Sharp, a Laravel-based content management framework. Authenticated users could manipulate the validation_rule parameter to upload arbitrary file types, bypassing MIME type and extension restrictions implemented on the client side.
Is CVE-2026-33687 being actively exploited?
No, CVE-2026-33687 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are available. However, the vulnerability is straightforward to exploit once discovered, so timely patching is still critical.
What versions of Sharp are affected by CVE-2026-33687?
All versions of Sharp prior to 9.20.0 are vulnerable. The vulnerability was patched in version 9.20.0 by removing client-controlled validation parameters and enforcing file upload rules server-side.
How do I check if my server is vulnerable to CVE-2026-33687?
Run composer show code16/sharp in your Laravel project directory and check if the version is below 9.20.0. If it is, your installation is vulnerable and requires an immediate update.
Does Defensia detect CVE-2026-33687?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Sharp is installed on a monitored Laravel application, CVE-2026-33687 will appear in your dashboard with remediation steps and recommended update instructions.
Related PHP CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-33687. Free for 1 server.
Get started free