Skip to content

Path Traversal via Unsanitized Extension in FileUtil (CWE-22)

High
aguingand published GHSA-9ffq-6457-8958 Mar 23, 2026

Package

composer code16/sharp (Composer)

Affected versions

< 9.20.0

Patched versions

9.20.0

Description

Summary

A path traversal vulnerability exists in the FileUtil class of the code16/sharp package. The application fails to sanitize file extensions properly, allowing path separators to be passed into the storage layer.

Detail

In src/Utils/FileUtil.php, the FileUtil::explodeExtension() function extracts a file's extension by splitting the filename at the last dot. However, the extracted extension is never sanitized. While the application uses a normalizeName() function, this function only cleans the base filename, meaning any path separators (such as /) injected into the extension will survive and be passed into the storeAs() function.

Impact

Exploiting this flaw allows an authenticated attacker to manipulate file paths:

  • Files can be written outside of the intended tmp directory via path traversal. For more details on the package, visit: https://github.com/code16/sharp
  • Existing critical files (such as .env or configuration files) could potentially be overwritten. Review the CWE definition here: https://cwe.mitre.org/data/definitions/22.html (Note: This vulnerability was successfully chained with CWE-434 in a local Proof of Concept to confirm the traversal.)

Patches

This issue has been patched by properly sanitizing the extension using pathinfo(PATHINFO_EXTENSION) instead of strrpos(), alongside applying strict regex replacements to both the base name and the extension. The fix is available in pull request #715

References

Credits

Reported by zaurgsynv.

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE ID

CVE-2026-33686

Weaknesses

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Learn more on MITRE.