Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The…

Sharp, a content management framework for Laravel, contains a path traversal vulnerability in versions prior to 9.20.0. The vulnerability exists in the FileUtil class where the application fails to properly sanitize file extensions, allowing path separators to be passed into the storage layer. The issue occurs in the FileUtil::explodeExtension() function which extracts file extensions by splitting filenames at the last dot. This vulnerability has been patched in version 9.20.0 by implementing proper extension sanitization using pathinfo(PATHINFO_EXTENSION) instead of strrpos() and applying strict regex replacements to both base names and extensions.