Listen to this Post
How the CVE Works
The flaw exists in Sharp’s generic download endpoint, which authorizes access based solely on a supplied entity instance (entityKey and instanceId), but then reads the storage `disk` and file `path` directly from request parameters. There is no check that the requested file belongs to the authorized instance.
An attacker with an authenticated Sharp session and view access to at least one valid entity instance can exploit this by intercepting a legitimate download request and modifying the `disk` and `path` parameters. The endpoint, having already authorized the user via the entity anchor, serves the requested file without verifying ownership.
The vulnerable endpoint is:
`GET /sharp/{globalFilter}/download/{entityKey}/{instanceId?}`
By changing `disk` and path, an attacker can download arbitrary files from any Laravel Storage disk accessible to the application, including those belonging to other records or tenants.
The fix introduces a signature mechanism: legitimate download URLs are signed, and any modification to disk, path, entityKey, or `instanceId` invalidates the signature, blocking the request.
dailycve form:
Platform: Laravel
Version: <9.22.0
Vulnerability: IDOR Authorization Bypass
Severity: High
date: 2026-05-15
Prediction: Patch date 2026-04-28
Analytics under What Undercode Say:
Check installed Sharp version
composer show code16/sharp
List all Laravel Storage disks
php artisan tinker --execute="print_r(config('filesystems.disks'));"
Find Sharp download endpoints in routes
php artisan route:list | grep download
Exploit:
Obtain a valid download URL for any accessible entity instance Modify the disk and path parameters to target sensitive files curl -X GET 'https://target.com/sharp/global/download/products/123?disk=local&path=../../config/app.php' \ -H 'Cookie: laravel_session=YOUR_SESSION_COOKIE'
Protection from this CVE
Upgrade to the patched version composer require code16/sharp:^9.22.0 composer update code16/sharp Restrict allowed disks in config/sharp.php 'downloads' => [ 'allowed_disks' => ['public'], Whitelist only necessary disks ], Clear cached configuration php artisan config:clear
Impact:
Unauthenticated file disclosure of exports, backups, invoices, internal documents, tenant-specific data, or operational files stored on private application disks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
