CVE-2026-44692: Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint

Synopsis

This is an insecure direct object reference (IDOR) vulnerability in Code16 Sharp, a Laravel content management framework. An attacker who holds any valid Sharp account can reach the generic file download endpoint over the network and supply arbitrary storage disk and path parameters, using a legitimately authorized entity record as an authorization anchor to bypass the intended access control. Successful exploitation lets the attacker read any file stored on configured Laravel Storage disks that the application can reach, regardless of which entity or record that file belongs to. A fix was introduced in Sharp version 9.22.0, and a patched-image rebuild at that version is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Sharp download endpoint is exposed over the network, so an attacker must be able to reach the application's HTTP interface to send crafted requests.

• AuthenticationRequired

  The attacker must hold a valid low-privilege Sharp account; any authenticated user with access to at least one valid entity record is sufficient to anchor the bypass.

• Victim interactionNot required

  No victim action is needed; the attacker sends requests directly to the download endpoint without involving another user.

• Attack complexityDetail

  Exploitation is reliable and condition-free: once the attacker has a valid session and a known entity record, no race conditions or special environmental factors are required.

Blast Radius

• Reads arbitrary files stored on any configured Laravel Storage disk, including uploaded documents, exported reports, and other application-managed files that belong to unrelated entities or tenants.
• Discloses data across logical access boundaries within the same application, meaning one tenant or user account can reach files that should be scoped to a different account.
• Does not grant write or delete access to storage objects, and does not extend outside the root paths of configured Laravel Storage disks to the broader host filesystem.