Stored Cross-Site Scripting Vulnerability in Code16 Sharp Laravel Framework

CVE-2026-61823

What is CVE-2026-61823?

The Code16 Sharp framework, a Laravel-based platform for content management, contains a stored cross-site scripting vulnerability in its rich-text editor. This issue arises from the HTML sanitizer allowing the srcdoc attribute within iframe elements. While the markup in srcdoc is encoded during sanitization, browsers decode the attribute entities prior to rendering, leading to a scenario where an authenticated user with editing privileges can insert executable JavaScript. This malicious script executes when another user views the edited content, resulting in potential session hijacking, unauthorized actions, account takeovers, or exposure of sensitive administrative information. Code16 has addressed this vulnerability in version 9.22.5 by disallowing the srcdoc attribute. Current users unable to upgrade should implement manual content sanitization to exclude any iframe srcdoc attributes during data storage or rendering.

References