Sharp versions before 9.20.0 contain a path traversal vulnerability (CWE-22) in the FileUtil class due to improper handling of file extensions. The function FileUtil::explodeExtension() used strrpos() to split filenames, which failed to sanitize path separators properly, enabling attackers to manipulate file paths. The vulnerability was patched in version 9.20.0 by switching to pathinfo(PATHINFO_EXTENSION) for extension extraction and enforcing strict regex sanitization on both the base name and extension to prevent traversal attacks.

Successful exploitation of this vulnerability could allow an attacker with at least low privileges (PR:L) to perform path traversal attacks, potentially leading to full confidentiality, integrity, and availability compromise of the affected system. This includes unauthorized reading, modification, or deletion of files outside the intended storage directories.

A fix is available in Sharp version 9.20.0, which properly sanitizes file extensions and prevents path traversal. Users should upgrade to version 9.20.0 or later to remediate this vulnerability. No additional vendor advisory was provided, so patch status beyond this version is not confirmed. Patch status is confirmed by the vendor's versioning and description.