CVE-2026-61825: Stored Cross-Site Scripting (XSS) via data-html-content Sanitizer Bypass in code16/sharp

Vulnerability ID: CVE-2026-61825
CVSS Score: 8.7
Published: 2026-09-25

CVE-2026-61825 is a high-severity, stored Cross-Site Scripting (XSS) vulnerability identified in code16/sharp, a Laravel-based administrative framework. The flaw resides within the administrative backend's rich-text and markdown editor field formatter. By bypassing HTML sanitization via crafted elements containing the data-html-content attribute or iframe srcdoc execution parameters, lower-privileged users can inject and execute arbitrary JavaScript code.

TL;DR

Stored Cross-Site Scripting (XSS) in code16/sharp prior to 9.22.5 allows lower-privileged users to bypass HTML sanitization and execute arbitrary JavaScript via crafted elements containing 'data-html-content' or iframe 'srcdoc' attributes.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-79
• Attack Vector: Network
• CVSS v3.1 Score: 8.7
• EPSS Score: 0.00219
• Impact: High (Stored XSS / Session Hijacking / Admin Takeover)
• Exploit Status: Proof-of-Concept (via Unit Tests)
• KEV Status: Not Listed

Affected Systems

• code16/sharp Laravel Administrative Framework
• sharp: < 9.22.5 (Fixed in: 9.22.5)

Code Analysis

Commit: ec509a2

Hardened server-side sanitization rules by conditioning 'data-html-content' parsing on the presence of RAW_HTML in the toolbar and removing 'srcdoc' from the allowed iframe attributes.

Mitigation Strategies

• Upgrade package dependency to version 9.22.5 or higher.
• Disable the RAW_HTML toolbar option in all SharpForm text fields.
• Add strict backend sanitization on content input streams.
• Deploy WAF rules to inspect and block requests carrying 'data-html-content' or 'srcdoc' attributes.

Remediation Steps:

1. Verify your currently installed version of code16/sharp using 'composer show code16/sharp'.
2. Run 'composer update code16/sharp' to pull version 9.22.5 or later.
3. Verify that the update is recorded in composer.lock and commit changes.
4. Scan codebase for occurrences of 'SharpFormEditorField::RAW_HTML' to confirm configuration safety.

References

• GitHub Security Advisory GHSA-vj3q-vp3g-j9c8
• Fix Commit ec509a22
• CVE-2026-61825 CVE Record
• NVD Vulnerability Details for CVE-2026-61825

Read the full report for CVE-2026-61825 on our website for more details including interactive diagrams and full exploit analysis.