TI-2025-38979 Aliases CVE-2025-62796 GHSA-867c-p784-5q6g

PrivateBin persistent HTML injection in attachment filename enables redirect and defacement

HIGH 65CWE-79Published 2025-10-28 · Updated 2025-10-29

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting, Spoofing
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79 and CWE-601.

Summary

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Versions 1.7.7 through 2.0.1 allow persistent HTML injection via the unsanitized attachment filename (attachment_name) when attachments are enabled. An attacker can modify attachment_name before encryption so that, after decryption, arbitrary HTML is inserted unescaped into the page near the file size hint, enabling redirect (e.g., meta refresh) and site defacement and related phishing attacks. Script execution is normally blocked by the recommended Content Security Policy, limiting confidentiality impact. The issue was introduced in 1.7.7 and fixed in 2.0.2. Update to 2.0.2 or later. Workarounds include enforcing the recommended CSP, deploying PrivateBin on a separate domain, or disabling attachments.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00295 22nd percentileScored 2026-11-07

Fix Fixed PrivateBin (PrivateBin): 2.0.2privatebin/privatebin (Packagist): 2.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PrivateBin	PrivateBin	1.7.7 to before 2.0.2	2.0.2	Patch available	CNA
—	privatebin/privatebin (Packagist)	1.7.7 to before 2.0.2	2.0.2	Patch available	GHSA-867c-p784-5q6g

PrivateBin VendorPrivateBin Affected 1.7.7 to before 2.0.2 Fixed in 2.0.2 Patch available CNA
privatebin/privatebin (Packagist) Vendor— Affected 1.7.7 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-867c-p784-5q6g

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:privatebin:privatebin::::::::	—	—	PrivateBin

cpe:2.3:a:privatebin:privatebin:*:*:*:*:*:*:*:* Versions — — ·PrivateBin

Remediation

Fix · CNA PrivateBin (PrivateBin) Fixed in 2.0.2
Fix · GHSA-867c-p784-5q6g privatebin/privatebin (Packagist) Fixed in 2.0.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-62796
2026-10-03 Alias added: GHSA-867c-p784-5q6g

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-62796

Other 4

TI-2022-08646 Persistent Cross-site Scripting (XSS) vulnerability in PrivateBin CVSS 3.1HIGH 8.2
TI-2025-40057 PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users CVSS 3.1MEDIUM 5.4
TI-2026-40342 PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI CVSS 3.1N/A 0.0
TI-2025-40060 PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal CVSS 3.1MEDIUM 5.8
TI-2024-26793 PrivateBin allows shortening of URLs for other domains CVSS 3.1MEDIUM 5.3
TI-2020-04279 Persistent XSS vulnerability in filename of attached file in PrivateBin CVSS 3.1MEDIUM 6.1

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences