GHSA-g2j9-g8r5-rg82
Medium · 5.8CVSS
5.8
EPSS
—
Published
Nov 14, 2025
CISA due date
—
The record
PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | privatebin/privatebin | 1.7.7 | 2.0.3 |
| packagist | privatebin/privatebin | 1.7.7 | 2.0.3 |
Related vulnerabilities
- CVE-2025-64714 PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Same vulnerability
- GHSA-r9x7-7ggj-fx9f PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for… Also affects privatebin/privatebin
- CVE-2025-64711 PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for… Also affects privatebin/privatebin
- CVE-2025-62796 PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Also affects privatebin/privatebin
- GHSA-867c-p784-5q6g PrivateBin is missing HTML sanitization of attached filename in file size hint Also affects privatebin/privatebin
- CVE-2026-114714 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal… CWE-23
- CVE-2026-106552 In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files… CWE-23
- CVE-2026-89065 Relative path traversal in the generated file manifest cleanup component in projen before… CWE-23