GHSA-867c-p784-5q6g
Medium · 5.8CVSS
5.8
EPSS
—
Published
Oct 28, 2025
CISA due date
—
The record
PrivateBin is missing HTML sanitization of attached filename in file size hint
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | privatebin/privatebin | 1.7.7 | 2.0.2 |
| packagist | privatebin/privatebin | 1.7.7 | 2.0.2 |
Related vulnerabilities
- CVE-2025-62796 PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Same vulnerability
- GHSA-r9x7-7ggj-fx9f PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for… Also affects privatebin/privatebin
- GHSA-g2j9-g8r5-rg82 PrivateBin's template-switching feature allows arbitrary local file inclusion through… Also affects privatebin/privatebin
- CVE-2025-64711 PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for… Also affects privatebin/privatebin
- CVE-2025-64714 PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Also affects privatebin/privatebin
- CVE-2026-87945 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO… CWE-601
- CVE-2026-87937 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central… CWE-601
- CVE-2026-112034 A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. CWE-601