Sharp CMS CVE-2025-62798

Exploitation requires that attacker-influenced content be rendered through the SharpShowTextField component of Sharp < 9.11.1, where values wrapped in {{ }} were evaluated by Vue instead of being displayed as text. Limiting factors: the attacker needs an authenticated account or some writable data path that feeds a SharpShowTextField (PR:L), and a victim must load the affected show view for the payload to execute (UI:R). It is specific to the SharpShowTextField text-rendering path; versions at or above 9.11.1, which HTML-encode the braces and drop Vue-related attributes, are not affected.

This is a moderate-severity, authenticated stored XSS in the Sharp CMS for Laravel, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, score 5.4) correctly describes a network-reachable but privilege- and interaction-gated flaw: an attacker needs an account that can supply content rendered through SharpShowTextField (PR:L), and a victim admin must view that field (UI:R). The scope change (S:C) reflects script executing in the authenticated admin-panel browser context, distinct from the vulnerable server component. EPSS is low at 0.22% (11th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so this is a real-but-not-urgent issue rather than a high-CVSS-but-low-real-risk mislabel - the modest CVSS and low EPSS agree. No SSVC data was provided. No signals conflict; the main caveat is that impact is partly contingent on how much untrusted content can actually reach a SharpShowTextField in a given deployment (e.g., whether a low-privilege role can set values an admin later reviews).

An attacker with a low-privilege Sharp account (or who can otherwise influence data surfaced in the admin) stores a value containing Vue template syntax such as {{ constructor.constructor('fetch(...)')() }} or {{ Math.random() }} in a field rendered by SharpShowTextField. When an authenticated administrator opens the show view, Vue evaluates the expression and executes attacker-controlled JavaScript in the admin's session. No public exploit code is identified, but the GHSA advisory and the fix diff make the trigger trivially reproducible (UI:R on an authenticated victim).