Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61825— code16/sharp has a stored XSS via data-html-content Sanitizer Bypass

Quick assessment

Affected
code16 sharp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Sharp 16 是一款基于 Laravel 的框架，用于构建内容管理系统和后台管理界面。在 9.22.5 版本之前， 中存在一个存储型跨站脚本（XSS）漏洞。攻击者可以提交带有 属性的受控内容，从而绕过 HTML sanitization（净化）机制并保留可执行的标记代码。当其他用户查看这些已存储的内容时，恶意脚本可能会执行。 厂商已将 9.22.5 版本标识为已修复该漏洞的版本。对于有意启用 配置的应用程序，开发者仍需自行对编辑器内容进行净化处理。 作为临时应对措施，建议应用程序在存储或渲染所有编辑器内容之前，

CVSS 8.7 · High EPSS 0.22% · P12

Affected Version Matrix 1

VendorProduct Version RangeStatus
code16 sharp < 9.22.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61825

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in `SharpEditorFormField`: attacker-controlled content bearing the `data-html-content` attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. The vendor identifies version 9.22.5 as patched; applications that intentionally enable `SharpFormEditorField::RAW_HTML` must continue to sanitize editor content themselves. As a workaround, applications should sanitize all editor content before storing or rendering it, for example with Symfony HtmlSanitizer, and disable RAW_HTML functionality where it is not required.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
code16 sharp < 9.22.5 -

II. Public POCs for CVE-2026-61825

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61825

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-61825 (1)

Vendor Advisories for CVE-2026-61825 (1)

IV. Related Vulnerabilities

Same product: sharp
Same vendor: code16
Same weakness: CWE-79

V. Comments for CVE-2026-61825

No comments yet

Leave a comment