CVE-2026-61825High· 8.7▾ Twilightcode16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in `SharpEditorFormField`: attacker-controlled content be…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.2%
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in SharpEditorFormField: attacker-controlled content bearing the data-html-content attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. The vendor identifies version 9.22.5 as patched; applications that intentionally enable SharpFormEditorField::RAW_HTML must continue to sanitize editor content themselves. As a workaround, applications should sanitize all editor content before storing or rendering it, for example with Symfony HtmlSanitizer, and disable RAW_HTML functionality where it is not required.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
code16/sharp < 9.22.5Patched in:
code16/sharp 9.22.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61823High· 7.3code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces
CVE-2026-114112High· 8.9Sharp before 0.35.4 RCE via bundled libheif AVIF decoding
CVE-2026-114111High· 8.9Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability
CVE-2026-114113High· 8.4Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decoders
GHSA-wq5f-xc86-pv6wHighsharp : Vulnerability in librsvg dependency CVE-2026-96889
GHSA-rgj7-g3m4-5g8cHighsharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545