Executive brief
PrivateBin is missing HTML sanitization of attached filename in file size hint
Affected products
- Packagist privatebin/privatebin
Junglewise Threat Intelligence
CVE-2025-62796: PrivateBin is missing HTML sanitization of attached filename in file size hint
CVE-2025-62796 · Severity: low · CVSS 3.1 · Published 2025-10-28
Technologies: privatebin/privatebin (Packagist). Vendors: Packagist.
Related threats
- PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri() in lib/Request
- PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/pr
- PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users
- PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal
- PrivateBin allows shortening of URLs for other domains