GHSA-r9x7-7ggj-fx9f
Low · 3.9CVSS
3.9
EPSS
—
Published
Nov 14, 2025
CISA due date
—
The record
PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | privatebin/privatebin | 1.7.7 | 2.0.3 |
| packagist | privatebin/privatebin | 1.7.7 | 2.0.3 |
Related vulnerabilities
- CVE-2025-64711 PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for… Same vulnerability
- GHSA-g2j9-g8r5-rg82 PrivateBin's template-switching feature allows arbitrary local file inclusion through… Also affects privatebin/privatebin
- CVE-2025-64714 PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Also affects privatebin/privatebin
- CVE-2025-62796 PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Also affects privatebin/privatebin
- GHSA-867c-p784-5q6g PrivateBin is missing HTML sanitization of attached filename in file size hint Also affects privatebin/privatebin
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79