CVE-2026-61825 Details
Description
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in `SharpEditorFormField`: attacker-controlled content bearing the `data-html-content` attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. The vendor identifies version 9.22.5 as patched; applications that intentionally enable `SharpFormEditorField::RAW_HTML` must continue to sanitize editor content themselves. As a workaround, applications should sanitize all editor content before storing or rendering it, for example with Symfony HtmlSanitizer, and disable RAW_HTML functionality where it is not required.
A stored cross-site scripting vulnerability has been identified in Code16 Sharp versions prior to 9.22.5. The issue resides in the SharpEditorFormField component, where content controlled by an attacker can bypass HTML sanitization. This allows executable markup to be preserved and potentially executed when another user views the content. The vulnerability arises from the improper handling of the data-html-content attribute, which can be exploited to inject malicious scripts or HTML that is not adequately sanitized before being displayed.
Users can update to Code16 Sharp version 9.22.5 or later, where this vulnerability has been patched. Applications that use the RAW_HTML feature must manually sanitize the content before storing or displaying it. As an additional step, consider using the Symfony HtmlSanitizer to clean editor content before it is saved or rendered.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/code16/sharp/commit/ec509a22c808a5bd9dfad6a0a85c92ce6f411e21 | [email protected] | Source CodeVendor |
| https://github.com/code16/sharp/security/advisories/GHSA-vj3q-vp3g-j9c8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| code16 Sharp | < 9.22.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |
| Sep 24, 2026 | CVE Modified | CISA-ADP |