TI-2026-44250 Aliases CVE-2026-61825 GHSA-vj3q-vp3g-j9c8

code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

LOW 39CWE-79Published 2026-09-24 · Updated 2026-09-24

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in `SharpEditorFormField`: attacker-controlled content bearing the `data-html-content` attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. The vendor identifies version 9.22.5 as patched; applications that intentionally enable `SharpFormEditorField::RAW_HTML` must continue to sanitize editor content themselves. As a workaround, applications should sanitize all editor content before storing or rendering it, for example with Symfony HtmlSanitizer, and disable RAW_HTML functionality where it is not required.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00232 14th percentileScored 2026-11-07

Fix Fixed sharp (code16): 9.22.5code16/sharp (Packagist): 9.22.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
code16	sharp	before 9.22.5	9.22.5	Patch available	CNA
—	code16/sharp (Packagist)	before 9.22.5	9.22.5	Patch available	GHSA-vj3q-vp3g-j9c8

sharp Vendorcode16 Affected before 9.22.5 Fixed in 9.22.5 Patch available CNA
code16/sharp (Packagist) Vendor— Affected before 9.22.5 Fixed in 9.22.5 Patch available GHSA-vj3q-vp3g-j9c8

Remediation

Fix · CNA sharp (code16) Fixed in 9.22.5
Fix · GHSA-vj3q-vp3g-j9c8 code16/sharp (Packagist) Fixed in 9.22.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-61825
2026-10-03 Alias added: GHSA-vj3q-vp3g-j9c8

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-61825

Other 3

TI-2026-26067 Sharp has Unrestricted File Upload via Client-Controlled Validation Rules CVSS 3.1HIGH 8.8
TI-2026-26066 Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil CVSS 3.1HIGH 8.8
TI-2026-44248 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute CVSS 3.1HIGH 7.3
TI-2026-32583 Authenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpoint CVSS 3.1HIGH 7.7
TI-2025-38981 Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax CVSS 3.1MEDIUM 5.4
TI-2026-38678 Sharp: Missing Authorization Check in Quick Creation Command Endpoints CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences