Sharp, a Laravel content‑management package, contains a path traversal flaw in its FileUtil class. The explodeExtension function extracts a file's extension by splitting on the last dot without sanitizing the result, allowing directory separators to be embedded in the extension. An attacker who can provide a crafted filename is able to cause the framework to read or write files outside the intended storage directory, potentially exposing sensitive data, overwriting critical configuration files, or escalating privileges according to the web server’s permissions.

The vulnerability affects all installations of code16’s Sharp framework released before version 9.20.0. Versions 9.20.0 and later include a patch that sanitizes extensions using pathinfo and strict regex checks.

The CVSS score for this flaw is 8.8, indicating high severity. The EPSS score is below 1 %, suggesting a low likelihood of widespread exploitation at present. It is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector involves exploiting file‑upload or file‑download functions that pass user‑supplied filenames through FileUtil, allowing an attacker to supply a malicious filename that manipulates the extension field.