Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-61825, describes a stored XSS bypass in code16/sharp through the data-html-content attribute. By analyzing the provided commit ec509a22c808a5bd9dfad6a0a85c92ce6f411e21, the key change is found in src/Utils/Sanitization/FormatsSanitizedValue.php within the isEncodingNeeded function. Prior to the patch, this function allowed the data-html-content attribute without checking if the RAW_HTML option was enabled in the editor's toolbar. This oversight meant that any content provided with data-html-content would not be properly sanitized, allowing for the injection of malicious HTML or scripts. The fix introduces a conditional check, ensuring that data-html-content is only permitted when SharpFormEditorField::RAW_HTML is explicitly configured, thereby closing the sanitization bypass. Therefore, FormatsSanitizedValue.isEncodingNeeded is identified as the vulnerable function responsible for this bypass.
FormatsSanitizedValue.isEncodingNeededsrc/Utils/Sanitization/FormatsSanitizedValue.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code16/sharp | composer | < 9.22.5 | 9.22.5 |