Is CVE-2026-61825 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61825 being exploited in the wild.

How severe is CVE-2026-61825?

High severity, with a CVSS score of 8.7, published 24 September 2026.

Which products and versions are affected?

Code16 Sharp < 9.22.5; code16/sharp (Packagist) < 9.22.5, ECOSYSTEM:introduced=0,fixed=9.22.5.

Is there a fix for CVE-2026-61825?

Yes. code16/sharp (Packagist): upgrade to 9.22.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61825 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61825?

Check whether you run Code16 Sharp or code16/sharp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61825: code16 Sharp stored XSS via sanitizer bypass

Q: Which products and versions are affected?

Code16 Sharp < 9.22.5; code16/sharp (Packagist) < 9.22.5, ECOSYSTEM:introduced=0,fixed=9.22.5.

Q: Is there a fix for CVE-2026-61825?

Yes. code16/sharp (Packagist): upgrade to 9.22.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-61825 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-61825?

Check whether you run Code16 Sharp or code16/sharp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61825 · Severity: high · CVSS 8.7 · Published 2026-09-24

code16/Sharp is a PHP admin framework for building data management interfaces. An attacker can bypass the built-in HTML sanitizer in editor fields by injecting malicious code through the data-html-content attribute, allowing stored cross-site scripting attacks. This allows unauthorized code execution in the browsers of users viewing the stored content, potentially leading to account takeover, data theft, or defacement.

Technologies: Code16 Sharp, code16/sharp (Packagist). Vendors: Code16, Packagist.

Quick answers

Is CVE-2026-61825 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61825 being exploited in the wild.
How severe is CVE-2026-61825?: High severity, with a CVSS score of 8.7, published 24 September 2026.
Which products and versions are affected?: Code16 Sharp < 9.22.5; code16/sharp (Packagist) < 9.22.5, ECOSYSTEM:introduced=0,fixed=9.22.5.
Is there a fix for CVE-2026-61825?: Yes. code16/sharp (Packagist): upgrade to 9.22.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61825 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61825?: Check whether you run Code16 Sharp or code16/sharp (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code16/sharp (Packagist): upgrade to 9.22.5 or later
```
composer require code16/sharp:^9.22.5
```

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the SharpEditorFormField component, where the HTML sanitizer can be bypassed using the data-html-content attribute. The vulnerable component fails to properly neutralize user-controllable input before rendering it in web pages served to other users. The attack requires network access and low-level privileges; user interaction is needed for the stored payload to execute. An authenticated user can inject malicious HTML/JavaScript that persists in the database and executes in the browsers of other users who view the content. The vulnerability has been patched in version 9.22.5, which now requires explicit configuration of the RAW_HTML button and mandates manual sanitization of editor content by the application.

Affected products

code16 Sharp < 9.22.5

Identifiers

CVE-2026-61825
GHSA-vj3q-vp3g-j9c8

Timeline

2026-06-24: disclosed
2026-09-25: patched: patched in version 9.22.5

References

https://api.github.com/users/nova-aryan

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.