Code16 Sharp CVE-2025-61457

Exploitation requires access to a Sharp upload field (SharpFormUploadField) and the ability to upload a file - in Sharp this is a back-office content-entry feature, so realistic abuse presupposes reaching that authenticated form despite the CVSS PR:N claim. The attacker must upload a crafted SVG whose embedded script survives because Sharp 9.6.6 does not sanitize uploaded SVGs by default. Exploitation is further limited by required user interaction (UI:R): a victim must subsequently view/render the stored SVG in the back-office for the script to fire. Only deployments running Sharp at or before 9.6.6 without the v9.7.0 sanitization are affected; the vulnerability does not apply once updated or when SVG upload is not used.

This is a moderate-severity stored Cross-Site Scripting flaw (CVSS 6.1) in code16 Sharp 9.6.6, a Laravel-based back-office/content-management framework. The signals point to a genuine but non-urgent issue rather than a top priority: EPSS is low at 0.33% (25th percentile), the vulnerability is NOT on the CISA KEV list, and there is no confirmation of active exploitation. The vuln.today decision label is 'this_month', consistent with a patch-when-convenient cadence rather than emergency action. A public PoC reference exists (chimmeee vulnerability-research writeup) but it is not verified as working exploit code. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) advertises an unauthenticated network attack with scope change requiring user interaction; however, this conflicts with the mechanism implied by the source: the flaw is in SharpFormUploadField and the v9.7.0 fix sanitizes uploaded SVG images, meaning an attacker must reach the Sharp upload form - typically an authenticated back-office function - so PR:N is questionable and likely understates the privilege requirement. Net: a real issue worth patching, but the combination of low EPSS, no KEV, required victim interaction, and probable authentication need makes it a routine-priority item, not a drop-everything emergency.

An attacker with access to a Sharp upload field submits a crafted SVG file containing embedded JavaScript, which Sharp 9.6.6 stores and later serves without sanitization. When an administrator or other user views the rendered SVG in the back-office, the embedded script executes in their browser session, enabling session/cookie theft or actions on their behalf. A public PoC reference exists but is not verified as working exploit code; exploitation requires the victim to view the stored content (UI:R).