PT-2026-28177 · Sharp · Sharp

Zaurgsynv · Published 2026-03-25 · Updated 2026-03-27 · CVE-2026-33686

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sharp versions prior to 9.20.0

Description The application does not properly sanitize file extensions, allowing path separators to be passed into the storage layer. The FileUtil::explodeExtension() function in src/Utils/FileUtil.php extracts a file's extension by splitting the filename at the last dot without sanitization. This allows an authenticated attacker to manipulate file paths and potentially write files outside the intended directory or overwrite critical files. The issue is related to the improper handling of file extensions during storage operations.

Recommendations Update to version 9.20.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-33686

GHSA-9FFQ-6457-8958

Affected Products

Sharp

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33686.json · Exploit
• https://github.com/code16/sharp/pull/715 · Patch
• https://github.com/code16/sharp/security/advisories/GHSA-9ffq-6457-8958 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33686 · Security Note
• https://osv.dev/vulnerability/GHSA-9ffq-6457-8958 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33686 · Vendor Advisory
• https://github.com/code16/sharp · Note
• https://twitter.com/TheHackerWire/status/2037296080229159317 · Twitter Post
• https://twitter.com/CVEnew/status/2037513419570495610 · Twitter Post
• https://twitter.com/CveFindCom/status/2037299407029223668 · Twitter Post