CVE-2026-33687: 
PHP vulnerability analysis and mitigation

CVE-2026-33687 is an unrestricted file upload vulnerability (CWE-434) in the code16/sharp Laravel admin panel package that allows authenticated users to bypass all file type restrictions and upload arbitrary files, including PHP webshells. It affects all versions of code16/sharp prior to 9.20.0. The vulnerability was reported by zaurgsynv, disclosed via GitHub Security Advisory on March 23, 2026, and published to the NVD on March 26, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Sharp Security Advisory).

The root cause is improper server-side validation of file uploads (CWE-434) in src/Http/Controllers/Api/ApiFormUploadController.php at line 24. The ApiFormUploadController upload endpoint accepts a client-controlled validation_rule parameter that is passed directly into the Laravel validator without server-side enforcement. An attacker can intercept the upload request and replace the validation_rule parameter with validation_rule[]=file, which completely bypasses all configured MIME type and file extension restrictions, allowing arbitrary file types to be uploaded. The fix, implemented in PR #714, removes client-controlled validation rules and enforces upload rules strictly on the server side (GitHub Advisory, Sharp PR #714).

Successful exploitation allows an authenticated attacker with low privileges to upload arbitrary files — including PHP webshells — to the server. If the Laravel storage disk is configured as publicly accessible, this can escalate to Remote Code Execution (RCE), enabling full server compromise, data exfiltration, and lateral movement within the hosting environment. Under default configurations where the storage disk is private, direct execution of uploaded PHP files is not possible, but the arbitrary file placement still poses a significant integrity risk (GitHub Advisory, Sharp Security Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (GitHub Advisory). The vulnerability requires low-privilege authenticated access, reducing the attack surface compared to unauthenticated flaws. The EPSS score is approximately 0.023% (7th percentile), indicating a low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Authenticate: Obtain valid low-privilege credentials to the Sharp Laravel admin panel (e.g., a standard editor or contributor account).
2. Identify the upload endpoint: Navigate to a form within the Sharp admin panel that includes a file upload field, which triggers requests to the ApiFormUploadController upload endpoint.
3. Intercept the upload request: Use a proxy tool such as Burp Suite or OWASP ZAP to intercept the HTTP POST request sent when uploading a file.
4. Manipulate the validation_rule parameter: In the intercepted request, locate the validation_rule parameter (which normally contains MIME/extension restrictions) and replace its value with validation_rule[]=file to strip all type restrictions.
5. Upload a PHP webshell: Forward the modified request with a PHP webshell payload (e.g., <?php system($_GET['cmd']); ?>) as the uploaded file, bypassing all server-side validation.
6. Achieve RCE (if public disk is configured): If the storage disk is publicly accessible, navigate to the uploaded file's public URL and execute arbitrary commands via the webshell (e.g., ?cmd=id). If the disk is private, the file is stored but not directly executable (GitHub Advisory, Sharp Security Advisory).

• Network: Unusual HTTP POST requests to the Sharp upload endpoint (e.g., /sharp/api/form/upload) containing a manipulated validation_rule[]=file parameter; outbound connections from the web server to unknown external IPs following a file upload event.
• File System: Presence of .php files or other executable scripts in the Laravel storage upload directories (e.g., storage/app/ or configured Sharp upload paths); unexpected files with webshell-like content (e.g., system(), exec(), passthru() PHP functions).
• Logs: Laravel application logs (storage/logs/laravel.log) showing upload requests with anomalous validation_rule parameters; web server access logs (Apache/Nginx) recording POST requests to the Sharp upload endpoint from authenticated sessions followed by GET requests to uploaded file paths.
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., bash, curl, wget, python) if RCE has been achieved via a publicly accessible uploaded webshell.

Update the code16/sharp Composer package to version 9.20.0 or later, which removes client-controlled validation rules and enforces file type restrictions server-side (Sharp v9.20.0 Release, Sharp PR #714). As an immediate workaround for those unable to upgrade, ensure the Laravel storage disk used for Sharp uploads is configured as strictly private, which prevents direct execution of any uploaded PHP files (Sharp Security Advisory). Additionally, consider disabling PHP execution in upload directories at the web server level (e.g., via Nginx/Apache configuration) and monitoring upload directories for unexpected executable file types.

The vulnerability was covered by The Hacker Wire shortly after disclosure, highlighting the file upload bypass mechanism and its RCE potential under misconfigured storage settings (The Hacker Wire). The advisory was also noted on Mastodon by security community accounts. Overall community reaction has been measured, reflecting the conditional nature of RCE exploitation (requiring a publicly accessible storage disk) and the availability of a patch.