CVE-2026-44692: Sharp Laravel CMS Information Disclosure

CVE-2026-44692 Overview

CVE-2026-44692 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in Sharp, a content management framework built as a Laravel package. Versions prior to 9.22.0 expose a generic download endpoint that authorizes requests against the supplied Sharp entity instance but reads the target storage disk and path from request parameters. An authenticated Sharp user who can view one valid record can use that record as an authorization anchor to download unrelated objects from configured Laravel Storage disks. The maintainers patched the issue in Sharp version 9.22.0.

Critical Impact
Authenticated attackers can disclose unrelated files stored on configured Laravel Storage disks by reusing a valid entity instance as an authorization anchor.

Affected Products

Sharp (code16/sharp) Laravel package versions prior to 9.22.0
Laravel applications integrating Sharp with one or more configured Storage disks
Sharp-managed entity download endpoints exposing disk and path parameters

Discovery Timeline

2026-06-10 - CVE-2026-44692 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-44692

Vulnerability Analysis

Sharp exposes a generic file download endpoint used by its administrative interface to retrieve files attached to managed entities. The endpoint enforces authorization by verifying that the requesting user can access the referenced Sharp entity instance. However, the storage disk identifier and file path are taken directly from request parameters and are not validated against the authorized entity instance.

This breaks the binding between the authorization decision and the resource being served. An attacker holding any valid entity reference can substitute the disk and path parameters to fetch unrelated objects. The flaw is classified under [CWE-639] Authorization Bypass Through User-Controlled Key. Access is limited to roots of configured Laravel Storage disks and does not extend to arbitrary host filesystem locations.

Root Cause

The authorization check validates the entity reference but does not verify that the requested storage object belongs to that entity. The download handler trusts client-supplied disk and path parameters when invoking the Laravel Storage facade, treating the authorized entity as a generic capability rather than a per-object grant.

Attack Vector

An authenticated Sharp user issues a request to the download endpoint using a valid entity identifier that they are authorized to view. The user replaces the disk parameter with another configured disk name and the path parameter with the relative path of a file on that disk. The endpoint returns the file contents because the entity-level authorization passes and the storage parameters are honored without rebinding.

The vulnerability requires authentication and network access to the Sharp administrative interface. No user interaction is required beyond the attacker's own session.

No public proof-of-concept code is available. See the GitHub Security Advisory GHSA-748w-hm6r-qc7v for maintainer-published technical details.

Detection Methods for CVE-2026-44692

Indicators of Compromise

Download requests to Sharp endpoints where the disk or path parameters reference objects unrelated to the entity identifier in the same request
Repeated download requests from a single authenticated session iterating through varying path values
Access patterns showing a single Sharp user retrieving files across multiple configured Laravel Storage disks within a short interval

Detection Strategies

Inspect Sharp HTTP access logs for download requests and correlate the supplied disk and path against the entity owner's expected file set
Alert when authenticated users request paths that do not match the directory conventions Sharp uses for the entity type referenced in the URL
Review Laravel application logs for Storage reads originating from the Sharp download controller that target files outside expected entity directories

Monitoring Recommendations

Enable verbose logging on Sharp download controllers, capturing the authenticated user, entity reference, requested disk, and requested path
Forward web server and Laravel logs to a centralized analytics or SIEM platform to baseline normal download behavior per user role
Track the volume and diversity of disk and path values requested per session to surface enumeration attempts

How to Mitigate CVE-2026-44692

Immediate Actions Required

Upgrade the code16/sharp Composer package to version 9.22.0 or later in all Laravel applications that embed Sharp
Audit configured Laravel Storage disks for sensitive content and rotate any credentials, tokens, or secrets that may have been stored on disks reachable through Sharp
Review authentication logs for Sharp administrative users and investigate sessions that exhibit unusual download patterns

Patch Information

The issue is fixed in Sharp 9.22.0. Update via Composer using composer require code16/sharp:^9.22.0 and redeploy the affected application. Release notes are available at the GitHub Release v9.22.0 page, and the disclosure is published in the GitHub Security Advisory GHSA-748w-hm6r-qc7v.

Workarounds

Restrict Sharp administrative access to trusted users only and enforce least-privilege role assignments until the upgrade is applied
Limit configured Laravel Storage disks accessible to the Sharp process so that sensitive buckets or directories are not reachable from the affected endpoint
Place the Sharp interface behind a network access control such as a VPN or IP allowlist to reduce exposure during the patch window

bash

# Configuration example: upgrade Sharp via Composer
composer require code16/sharp:^9.22.0
php artisan config:clear
php artisan cache:clear