Listen to this Post
CVE-2026-61825 is a stored cross-site scripting vulnerability in code16/sharp, a Laravel-based framework for building content-management and administrative interfaces. The flaw resides in the `SharpEditorFormField` component, where the built-in HTML sanitizer can be bypassed by leveraging the `data-html-content` attribute. When an attacker injects content containing this specific attribute, the sanitizer fails to strip executable markup, allowing malicious JavaScript to persist in the stored editor content. This payload remains dormant until another user views the affected field, at which point the script executes in the context of the victim’s browser session.
The vulnerability affects all versions of code16/sharp prior to 9.22.5. The attack vector is network-based with low complexity and low privileges required, though user interaction is necessary for the payload to trigger. According to the CVSS v3.1 metrics, the base score is 8.7, reflecting high confidentiality and integrity impact while availability remains unaffected. The scope is changed, meaning the vulnerable component impacts resources beyond its security scope. The CWE classification is CWE-79, improper neutralization of input during web page generation.
The vendor has addressed this issue in version 9.22.5 by requiring the field to explicitly configure `SharpFormEditorField::RAW_HTML` in the toolbar to retain the previous behavior. Applications that intentionally enable the RAW_HTML button must now manually sanitize content coming from the field. As a workaround, developers should sanitize all editor content before storing or rendering it, for example using Symfony HtmlSanitizer, and disable RAW_HTML functionality where it is not required. No public proof-of-concept exploit code has been detected as of the disclosure date.
DailyCVE Form:
Platform: code16/sharp
Version: Pre-9.22.5
Vulnerability: Stored XSS bypass
Severity: High
date: Jun 24, 2026
Prediction: Sep 25, 2026
What Undercode Say:
curl -X POST https://target.example/admin/sharp/editor \
-H "Content-Type: application/json" \
-d '{"content":"
<div data-html-content=\"<script>alert(1)</script>\">x</div>
"}'
// Vulnerable field configuration (pre-9.22.5)
SharpFormEditorField::make('content')
->toolbar(['bold', 'italic', 'RAW_HTML']);
// Patched configuration (9.22.5+)
SharpFormEditorField::make('content')
->toolbar(['bold', 'italic']) // RAW_HTML removed
// or explicitly:
->toolbar([SharpFormEditorField::RAW_HTML]); // requires manual sanitization
Exploit: (Educational Purposes!)
- Authenticate as a low-privileged user with access to an editor field.
- Submit content containing `data-html-content` with embedded script payload.
- The sanitizer permits the attribute and preserves inner markup.
4. Payload stores in database without sanitization.
- Any user viewing the editor field triggers execution.
Protection: from this CVE
Upgrade code16/sharp to version 9.22.5 or later. If upgrade is not possible, manually sanitize all editor content using Symfony HtmlSanitizer before storage and rendering. Remove RAW_HTML from toolbar configurations unless explicitly required. Disable RAW_HTML functionality entirely where it is not business-critical.
Impact:
Successful exploitation enables session hijacking, credential theft, and arbitrary actions on behalf of the victim. Attackers can exfiltrate sensitive data, modify application content, or escalate privileges within the CMS. The integrity and confidentiality of the application are fully compromised, though availability remains unaffected. Stored XSS persists until the malicious content is removed from the database.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
