CVE-2026-61825

HighCVSS 8.7

Published: 24/09/2026(UTC)Updated: 29/09/2026(UTC)Translated: 25/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

code16 Sharp, a Laravel-based framework for building content-management and administrative interfaces, prior to 9.22.5 contains a stored cross-site scripting vulnerability in SharpEditorFormField. Attacker-controlled content bearing the data-html-content attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. Version 9.22.5 is identified as patched.

Risk Assessment

An attacker can store malicious JavaScript that executes in another user's browser, potentially leading to session hijacking or unauthorized actions. Applications intentionally enabling RAW_HTML must sanitize editor content themselves.

Recommendation

Upgrade code16 Sharp to version 9.22.5 or later. If upgrading is not possible, sanitize all editor content before storing or rendering it (e.g., with Symfony HtmlSanitizer) and disable RAW_HTML where not required.

Other vulnerabilities in code16 Sharp

CVE-2026-61823High
code16 Sharp, a Laravel-based framework for building content-management and administrative interfaces, prior to 9.22.5 contains a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup inside srcdoc is HTML-encoded during sanitization, browsers decode attribute entities before interpreting the iframe document, allowing an authenticated user with permission to edit an Editor field to store executable JavaScript that runs when another user views the content. Version 9.22.5 removes srcdoc from permitted iframe attributes.

Original NVD description (English source)

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in `SharpEditorFormField`: attacker-controlled content bearing the `data-html-content` attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. The vendor identifies version 9.22.5 as patched; applications that intentionally enable `SharpFormEditorField::RAW_HTML` must continue to sanitize editor content themselves. As a workaround, applications should sanitize all editor content before storing or rendering it, for example with Symfony HtmlSanitizer, and disable RAW_HTML functionality where it is not required.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS