The vulnerability resides in Sharp's FileUtil::explodeExtension() method, which obtains a file's extension by splitting on the last period. Because user‑controlled file paths are not sanitized, an attacker can inject path separator characters into the extension field. This defect permits the application to reference files outside the intended upload or storage directory, potentially reading sensitive files or writing arbitrary data, thereby compromising confidentiality and integrity. The weakness is a classic path traversal flaw (CWE‑22).

Sharp is a Laravel package built by code16, used as a content management framework. Versions prior to 9.20.0 are affected. Applications deploying these versions without the hardening introduced in 9.20.0 are vulnerable.

The CVSS score of 8.8 classifies this flaw as High severity. Because the flaw can be triggered when the application processes user‑supplied filenames – which typically occurs in publicly exposed upload or file handling endpoints – the likely attack vector is remote via network exposure. No exploit probability data (EPSS) is supplied, and the flaw is not yet listed in CISA's KEV catalog, but the high CVSS combined with potential remote exploitation makes immediate attention prudent. An attacker with sufficient input control could read or overwrite arbitrary files on the server, leading to data theft, tampering, or even control of the application.