Executive brief
Sharp, a content management framework for Laravel, contains a vulnerability that allows authenticated users to download files they are not authorized to access. By manipulating request parameters on a valid download link, a user could access sensitive data such as backups, invoices, or internal documents stored on the server's storage disks. This could lead to the exposure of private customer data or operational files belonging to other users or tenants.
Technical details
A vulnerability exists in Sharp's generic download endpoint (GET /sharp/{globalFilter}/download/{entityKey}/{instanceId?}) where authorization is verified for a specific entity instance, but the actual file retrieval is based on user-controlled 'disk' and 'path' request parameters. Because the requested storage object is not cryptographically or logically bound to the authorized entity instance, an authenticated attacker with view access to at least one valid record can use it as an 'authorization anchor' to download any file from configured Laravel Storage disks. This is classified as an Insecure Direct Object Reference (IDOR) or Authorization Bypass Through User-Controlled Key (CWE-639). The issue is resolved in version 9.22.0 by implementing signed URLs that prevent parameter tampering.
Affected products
- code16 sharp < 9.22.0
Timeline
- 2026-05-15: advisory
- 2026-05-15: disclosed
- 2026-05-15: patched: Fixed in version 9.22.0