code16 Sharp CVE-2026-61825

Exploitation requires an authenticated user with permission to submit content into a SharpEditorFormField (PR:L) and a second user viewing that stored content (UI:R). The specific trigger is content bearing the data-html-content attribute (and, pre-fix, iframe srcdoc), which bypassed the server-side HtmlSanitizer even when the SharpFormEditorField::RAW_HTML toolbar button was NOT enabled - that unconditional preservation is the bug the patch fixes. Limiting factors: attacker needs a valid editor-level account on the Sharp admin panel, a victim must open the stored record, and applications that intentionally enable RAW_HTML remain responsible for their own sanitization (so those deployments are expected to be affected by design and must self-mitigate). Not remotely exploitable against an unauthenticated default install.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, base 8.7) describes a network-reachable stored XSS requiring a low-privileged authenticated account to inject content and a victim (typically a higher-privileged admin) to later view it. The scope change (S:C) is justified because injected script executes in the victim's browser session, a different security authority than the vulnerable server-side sanitizer. There is NO EPSS score, NO CISA KEV listing, and NO public exploit code in the provided data - so exploitation is 'no public exploit identified at time of analysis'. This tempers the high 8.7 base: the flaw is real and the fix commit (ec509a22) plus a regression test confirm the root cause, but the absence of KEV/EPSS/POC signals means this is not evidence of active or widespread exploitation. The C:H/I:H impact rating is arguably generous for a trusted-user stored XSS confined to an admin CMS - real impact depends on session theft/action-on-behalf within the Sharp admin panel, and I lean toward C:L/I:L (see assessed vector). Net: a legitimate priority to patch for anyone running Sharp with multi-user editor access, but not an emergency mass-exploitation candidate given the niche footprint and PR:L + UI:R gating.

A low-privileged content editor in a Sharp-powered admin panel submits editor field content containing an element with the data-html-content attribute (e.g. an iframe srcdoc or div carrying script markup) that bypasses the HtmlSanitizer even when the RAW_HTML toolbar button is not enabled. When an administrator or another user later opens that stored record in the admin interface, the preserved executable markup runs in their authenticated browser session. No public exploit code is identified, though the fix commit includes unit tests demonstrating the payload structure.