CVE-2025-62798
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ & }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. The issue has been fixed in v9.11.1.
Risk Assessment
An attacker can inject malicious JavaScript that executes in the victim's browser, potentially leading to session theft or account takeover.
Recommendation
Update the code16/sharp package to version 9.11.1 or later.
Other vulnerabilities in Sharp
See all- GHSA-f88m-g3jw-g9cjHigh
Several vulnerabilities have been discovered and fixed in the upstream libvips dependency, two rated as high severity using CVSSv4. Versions of sharp prior to 0.35.0 processing untrusted input are affected.
- CVE-2026-53634Medium
Sharp, a Laravel content management framework, from version 9.0.0 to before 9.22.3 does not enforce authorization checks on the create and store endpoints of the Quick Creation Command feature. An authenticated Sharp user without create permission on a given entity can bypass authorization and create new records for that entity if a Quick Creation Command handler is configured.
- CVE-2026-44692High
Sharp, a CMS framework for Laravel, prior to version 9.22.0 exposes a generic download endpoint that authorizes access only to the entity instance but reads the target disk and path from request parameters. An authenticated Sharp user who can view one valid record may use it as an authorization anchor to download unrelated objects from Laravel Storage disks.
Original NVD description (English source)
Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ & }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. The issue has been fixed in v9.11.1 .
Vulnerability data from NVD (NIST) · CISA KEV · EPSS