Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code16/sharp | composer | < 9.22.0 | 9.22.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the code16/sharp package, where an authenticated user could download unauthorized files. This was possible due to an insecure download endpoint that did not properly validate if the user was authorized to access the requested file. The analysis of the provided patches reveals two key areas of interest.
The primary vulnerable function is Code16\Sharp\Http\Controllers\Api\DownloadController::show. The patch for this function introduces a check for a valid signature on the request URL. The absence of this check in vulnerable versions allowed an attacker to forge requests to download arbitrary files by manipulating the disk and path parameters. Any runtime profile of an exploit would show a call to this function.
Secondly, the function Code16\Sharp\Form\Eloquent\Uploads\Transformers\SharpUploadModelFormAttributeTransformer::transformUpload was modified to generate these signed URLs. While not directly exploitable, its previous implementation was a necessary precondition for the vulnerability, as it created the insecure URLs. The fix was to use Laravel's URL::temporarySignedRoute to generate URLs with a cryptographic signature, preventing tampering.
The root cause is a CWE-639 (Authorization Bypass Through User-Controlled Key) vulnerability. The application failed to ensure that the user was authorized for the specific resource (disk and path) they were requesting, relying only on general authentication.
Code16\Sharp\Http\Controllers\Api\DownloadController::showsrc/Http/Controllers/Api/DownloadController.php
Code16\Sharp\Form\Eloquent\Uploads\Transformers\SharpUploadModelFormAttributeTransformer::transformUploadsrc/Form/Eloquent/Uploads/Transformers/SharpUploadModelFormAttributeTransformer.php