Threats Tagged 'cve-2026-33687'

Sharp, a Laravel content management framework package, has a vulnerability in versions prior to 9.20.0 that allows authenticated users to bypass file type restrictions on uploads. The issue arises because the file upload endpoint accepts a client-controlled validation_rule parameter, which is passed directly to the Laravel validator without proper server-side checks. This enables attackers to bypass MIME type and file extension restrictions by manipulating the validation_rule parameter. The vulnerability is addressed in version 9.20.0 by removing client control over validation rules and enforcing strict server-side upload rules. A workaround is to ensure the storage disk for uploads is private, as default configurations prevent direct execution of uploaded PHP files unless a public disk is used.