CVE-2026-55696: PrivateBin stored XSS in attachment download link

CVE-2026-55696 · Severity: medium · CVSS 4.3 · Published 2026-08-28

PrivateBin is a web application for sharing encrypted pastes and files. A stored cross-site scripting (XSS) vulnerability allows an attacker to create a malicious paste with an HTML attachment that executes JavaScript in the victim's browser with full access to the instance's origin (cookies, localStorage, and ability to make authenticated requests). The attack requires the victim to click "Open in new tab" on the download link and only affects instances with file upload enabled and non-default security settings.

Technologies: privatebin/privatebin (Packagist), PrivateBin. Vendors: Packagist, PrivateBin.

Quick answers

Is CVE-2026-55696 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55696 being exploited in the wild.
How severe is CVE-2026-55696?
Medium severity, with a CVSS score of 4.3, published 28 August 2026.
Which products and versions are affected?
privatebin/privatebin (Packagist) <= 2.0.4, ECOSYSTEM:introduced=0,fixed=2.0.5; PrivateBin <= 2.0.4.
Is there a fix for CVE-2026-55696?
Yes. privatebin/privatebin (Packagist): upgrade to 2.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55696 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55696?
Check whether you run privatebin/privatebin (Packagist) or PrivateBin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • privatebin/privatebin (Packagist): upgrade to 2.0.5 or later
    composer require privatebin/privatebin:^2.0.5

Technical details

The vulnerability is a stored XSS in PrivateBin's attachment handling, specifically in the `AttachmentViewer.setAttachment` function in `js/privatebin.js`. The root causes are: (1) DOMPurify sanitization only applies to SVG MIME types (`/^image\/.*svg/i`), allowing other HTML-like types (text/html, application/xhtml+xml, text/xml) to bypass sanitization; (2) the download link's href is set to an unsanitized blob URL before sanitization is applied, and the sanitization branch only updates a local variable consumed by the preview; (3) the MIME type is fully attacker-controlled, extracted from the encrypted payload that only the client can decrypt. An attacker creates a paste with an HTML attachment; when the victim opens the download link in a new tab, the browser renders the blob as a same-origin HTML document in the PrivateBin instance's origin, executing injected JavaScript. This is an incomplete fix of CVE-2022-24833. Exploitation requires: fileupload enabled (non-default), a weakened CSP (not the recommended default), and user interaction (opening the link in a new tab). The fix involves overwriting dangerous MIME types with `application/octet-stream` for downloads, forcing browser downloads instead of inline rendering.

Affected products

  • PrivateBin PrivateBin <= 2.0.4

Identifiers

  • CVE-2026-55696
  • GHSA-f2xf-7x3g-4272

Timeline

  • 2026-06-11: disclosed: Vulnerability reported via GitHub Security Advisory
  • 2026-06-13: other: Vulnerability reproduced and patch development started
  • 2026-06-14: other: Patch reviewed
  • 2026-06-15: patched: Patch merged into repository (estimated from timeline)
  • 2026-08-28: other: Vulnerability details published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.