Executive brief
PrivateBin allows shortening of URLs for other domains
Affected products
- Packagist privatebin/privatebin
Junglewise Threat Intelligence
CVE-2024-39899: PrivateBin allows shortening of URLs for other domains
CVE-2024-39899 · Severity: low · CVSS 3.1 · Published 2024-07-10
Technologies: privatebin/privatebin (Packagist). Vendors: Packagist.
Related threats
- PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri() in lib/Request
- PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/pr
- PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users
- PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal
- PrivateBin is missing HTML sanitization of attached filename in file size hint