Executive brief
code16/Sharp is a PHP admin framework for building data management interfaces. An attacker can bypass the built-in HTML sanitizer in editor fields by injecting malicious code through the data-html-content attribute, allowing stored cross-site scripting attacks. This allows unauthorized code execution in the browsers of users viewing the stored content, potentially leading to account takeover, data theft, or defacement.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the SharpEditorFormField component, where the HTML sanitizer can be bypassed using the data-html-content attribute. The vulnerable component fails to properly neutralize user-controllable input before rendering it in web pages served to other users. The attack requires network access and low-level privileges; user interaction is needed for the stored payload to execute. An authenticated user can inject malicious HTML/JavaScript that persists in the database and executes in the browsers of other users who view the content. The vulnerability has been patched in version 9.22.5, which now requires explicit configuration of the RAW_HTML button and mandates manual sanitization of editor content by the application.
Affected products
- code16 Sharp < 9.22.5
Timeline
- 2026-06-24: disclosed
- 2026-09-25: patched: patched in version 9.22.5