CVE-2025-62798: medium-severity vulnerability in code16 sharp
Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.2%
Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ & }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. The issue has been fixed in v9.11.1 .
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
code16 · sharpRelated CVEs — code16 sharp
In the same product, most dangerous first.
CVE-2026-33686HIGHSharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtilEPSS 0.6%CVE-2026-33687HIGHSharp has Unrestricted File Upload via Client-Controlled Validation RulesEPSS 0.5%CVE-2026-44692HIGHAuthenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpointEPSS 0.3%CVE-2026-61825HIGHcode16/sharp has a stored XSS via data-html-content Sanitizer BypassEPSS 0.2%CVE-2026-53634MEDIUMSharp: Missing Authorization Check in Quick Creation Command EndpointsEPSS 0.2%CVE-2026-61823HIGHcode16 Sharp vulnerable to stored XSS via iframe srcdoc AttributeEPSS 0.2%