TI-2025-40060 Aliases CVE-2025-64714 GHSA-g2j9-g8r5-rg82

PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal

LOW 33CWE-23Published 2025-11-13 · Updated 2025-11-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure, Code execution
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-23, CWE-98 and the CVSS impact.

Summary

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, an unauthenticated Local File Inclusion exists in the template-switching feature. If `templateselection` is enabled in the configuration, the server trusts the `template` cookie and includes the referenced PHP file. An attacker can read sensitive data or, if they manage to drop a PHP file elsewhere, gain remote code execution. The constructed path of the template file is checked for existence, then included. For PrivateBin project files this does not leak any secrets due to data files being created with PHP code that prevents execution, but if a configuration file without that line got created or the visitor figures out the relative path to a PHP script that directly performs an action without appropriate privilege checking, those might execute or leak information. The issue has been patched in version 2.0.3. As a workaround, set `templateselection = false` (which is the default) in `cfg/conf.php` or remove it entirely

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00529 44th percentileScored 2026-11-07

Fix Fixed PrivateBin (PrivateBin): 2.0.3privatebin/privatebin (Packagist): 2.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PrivateBin	PrivateBin	1.7.7 to before 2.0.3	2.0.3	Patch available	CNA
—	privatebin/privatebin (Packagist)	1.7.7 to before 2.0.3	2.0.3	Patch available	GHSA-g2j9-g8r5-rg82

PrivateBin VendorPrivateBin Affected 1.7.7 to before 2.0.3 Fixed in 2.0.3 Patch available CNA
privatebin/privatebin (Packagist) Vendor— Affected 1.7.7 to before 2.0.3 Fixed in 2.0.3 Patch available GHSA-g2j9-g8r5-rg82

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:privatebin:privatebin::::::::	—	—	PrivateBin

cpe:2.3:a:privatebin:privatebin:*:*:*:*:*:*:*:* Versions — — ·PrivateBin

Remediation

Fix · CNA PrivateBin (PrivateBin) Fixed in 2.0.3
Fix · GHSA-g2j9-g8r5-rg82 privatebin/privatebin (Packagist) Fixed in 2.0.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-64714
2026-10-03 Alias added: GHSA-g2j9-g8r5-rg82

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-64714

Other 3

TI-2022-08646 Persistent Cross-site Scripting (XSS) vulnerability in PrivateBin CVSS 3.1HIGH 8.2
TI-2025-38979 PrivateBin persistent HTML injection in attachment filename enables redirect and defacement CVSS 3.1MEDIUM 5.8
TI-2025-40057 PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users CVSS 3.1MEDIUM 5.4
TI-2026-40342 PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI CVSS 3.1N/A 0.0
TI-2024-26793 PrivateBin allows shortening of URLs for other domains CVSS 3.1MEDIUM 5.3
TI-2020-04279 Persistent XSS vulnerability in filename of attached file in PrivateBin CVSS 3.1MEDIUM 6.1

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences