Executive brief
PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users
Affected products
- Packagist privatebin/privatebin
Junglewise Threat Intelligence
CVE-2025-64711: PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users
CVE-2025-64711 · Severity: low · CVSS 3.1 · Published 2025-11-14
Technologies: privatebin/privatebin (Packagist). Vendors: Packagist.
Related threats
- PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri() in lib/Request
- PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/pr
- PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal
- PrivateBin is missing HTML sanitization of attached filename in file size hint
- PrivateBin allows shortening of URLs for other domains