CVE-2026-61825
Received Received - Intake

BaseFortify

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in `SharpEditorFormField`: attacker-controlled content bearing the `data-html-content` attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. The vendor identifies version 9.22.5 as patched; applications that intentionally enable `SharpFormEditorField::RAW_HTML` must continue to sanitize editor content themselves. As a workaround, applications should sanitize all editor content before storing or rendering it, for example with Symfony HtmlSanitizer, and disable RAW_HTML functionality where it is not required.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-61825
EUVD
EUVD-2026-86384

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the code16 Sharp Laravel framework before version 9.22.5. It affects the SharpEditorFormField component where attacker-controlled content with the data-html-content attribute can bypass HTML sanitization and retain executable markup. This malicious content executes when other users view the stored data.

Detection Guidance

To detect this vulnerability, inspect Laravel applications using code16 Sharp versions before 9.22.5. Check for instances of SharpEditorFormField with data-html-content attributes that may bypass sanitization. Review stored content for executable markup in editor fields.

Impact Analysis

An attacker could exploit this to inject malicious scripts into web pages viewed by other users. This may lead to unauthorized actions on behalf of users, theft of sensitive data like session cookies, or defacement of the application. The impact depends on user privileges and the nature of the stored content.

Compliance Impact

This vulnerability could lead to data breaches, exposing personal or sensitive information. For GDPR, it may result in unauthorized processing or disclosure of personal data, violating principles of data protection. For HIPAA, it could compromise protected health information, leading to compliance violations and legal penalties.

Mitigation Strategies

Upgrade code16 Sharp to version 9.22.5 or later. If RAW_HTML functionality is used, ensure manual sanitization of editor content with tools like Symfony HtmlSanitizer. Disable RAW_HTML where not required and sanitize all editor content before storage or rendering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61825. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart