Sharp versions before 9.20.0 allow an authenticated user to upload any file type because the client specifies a validation_rule parameter that bypasses the server‑side file type checks. By sending validation_rule[]=file the attacker can override MIME type and extension restrictions, potentially placing malicious files on the server. If the upload disk is publicly accessible, this could lead to code execution; if it is private, the files remain non‑executable but still expose the system to further compromise.

The affected product is Code16 Sharp, a Laravel package used for content management. All Sharp installations running versions older than 9.20.0 are vulnerable. The issue arises in the ApiFormUploadController handling file uploads.

The CVSS score of 8.8 classifies this vulnerability as high severity. The EPSS score of less than one percent indicates low current exploitation probability, and it is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the upload endpoint, but the lack of server‑side restriction makes it straightforward once access is obtained. If uploads are saved to a publicly reachable disk, the risk of remote code execution rises significantly. Until a patch is applied, administrators should treat the vulnerability as a serious concern.