Is CVE-2026-44692 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44692 being exploited in the wild.

How severe is CVE-2026-44692?

High severity, with a CVSS score of 7.7, published 10 June 2026.

Which products and versions are affected?

Code16 Sharp < 9.22.0; code16/sharp (Packagist) < 9.22.0, ECOSYSTEM:introduced=0,fixed=9.22.0.

Is there a fix for CVE-2026-44692?

Yes. code16/sharp (Packagist): upgrade to 9.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44692 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44692?

Check whether you run Code16 Sharp or code16/sharp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44692: code16 Sharp authorization bypass in generic download endpoint

Q: Which products and versions are affected?

Code16 Sharp < 9.22.0; code16/sharp (Packagist) < 9.22.0, ECOSYSTEM:introduced=0,fixed=9.22.0.

Q: Is there a fix for CVE-2026-44692?

Yes. code16/sharp (Packagist): upgrade to 9.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44692 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44692?

Check whether you run Code16 Sharp or code16/sharp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44692 · Severity: high · CVSS 7.7 · Published 2026-06-10

Sharp, a content management framework for Laravel, contains a vulnerability that allows authenticated users to download files they are not authorized to access. By manipulating request parameters on a valid download link, a user could access sensitive data such as backups, invoices, or internal documents stored on the server's storage disks. This could lead to the exposure of private customer data or operational files belonging to other users or tenants.

Technologies: Code16 Sharp, code16/sharp (Packagist). Vendors: Code16, Packagist.

Quick answers

Is CVE-2026-44692 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44692 being exploited in the wild.
How severe is CVE-2026-44692?: High severity, with a CVSS score of 7.7, published 10 June 2026.
Which products and versions are affected?: Code16 Sharp < 9.22.0; code16/sharp (Packagist) < 9.22.0, ECOSYSTEM:introduced=0,fixed=9.22.0.
Is there a fix for CVE-2026-44692?: Yes. code16/sharp (Packagist): upgrade to 9.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44692 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44692?: Check whether you run Code16 Sharp or code16/sharp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code16/sharp (Packagist): upgrade to 9.22.0 or later
```
composer require code16/sharp:^9.22.0
```

Technical details

A vulnerability exists in Sharp's generic download endpoint (GET /sharp/{globalFilter}/download/{entityKey}/{instanceId?}) where authorization is verified for a specific entity instance, but the actual file retrieval is based on user-controlled 'disk' and 'path' request parameters. Because the requested storage object is not cryptographically or logically bound to the authorized entity instance, an authenticated attacker with view access to at least one valid record can use it as an 'authorization anchor' to download any file from configured Laravel Storage disks. This is classified as an Insecure Direct Object Reference (IDOR) or Authorization Bypass Through User-Controlled Key (CWE-639). The issue is resolved in version 9.22.0 by implementing signed URLs that prevent parameter tampering.

Affected products

code16 sharp < 9.22.0

Identifiers

CVE-2026-44692
GHSA-748w-hm6r-qc7v

Timeline

2026-05-15: advisory
2026-05-15: disclosed
2026-05-15: patched: Fixed in version 9.22.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.