Sharp’s file upload endpoint accepts a client‑controlled validation_rule parameter that is passed directly to Laravel’s validator with no server‑side enforcement. Because an authenticated user can set validation_rule[]=file, the original file type and MIME type restrictions are completely bypassed, allowing the upload of any file type. While the default configuration does not execute PHP files unless a public disk is used, the ability to upload arbitrary files can compromise confidentiality and integrity if the upload location is misconfigured or later exploited.

The vulnerability affects the Sharp content‑management framework distributed by code16. All releases prior to version 9.20.0 are vulnerable. Any Laravel application that includes Sharp and uses its default upload endpoint exposes users who are authenticated to the system.

The CVSS score of 8.8 classifies this issue as high severity. No EPSS score is available and it is not listed in CISA’s KEV catalog, yet the vulnerability remains exploitable because it only requires authenticated access—a capability often granted to normal users in CMS environments. The exploit chain involves crafting a request that includes validation_rule[]=file; this enables the attacker to upload files without restriction, potentially leading to further compromise if the upload storage is publicly accessible or if other vulnerabilities are present.