CVE-2026-33687: Sharp has Unrestricted File Upload via Client-Controlled Validation Rules

March 25, 2026 (updated March 27, 2026)

The code16/sharp Laravel admin panel package contains a vulnerability in its file upload endpoint that allows authenticated users to bypass all file type restrictions.

References

github.com/advisories/GHSA-fr76-5637-w3g9
github.com/code16/sharp
github.com/code16/sharp/pull/714
github.com/code16/sharp/releases/tag/v9.20.0
github.com/code16/sharp/security/advisories/GHSA-fr76-5637-w3g9
laravel.com/docs/13.x/filesystem
nvd.nist.gov/vuln/detail/CVE-2026-33687

Code Behaviors & Features

Detect and mitigate CVE-2026-33687 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →