HTML Injection Vulnerability in PrivateBin Affects User Data Security
CVE-2025-62796

5.8MEDIUM

Key Information:

Vendor

Privatebin

Status
Privatebin
Vendor
CVE Published:
28 October 2025

What is CVE-2025-62796?

Versions 1.7.7 through 2.0.1 of PrivateBin are vulnerable to persistent HTML injection due to inadequate sanitization of the attachment filename. This vulnerability allows attackers to manipulate the 'attachment_name' field, which can lead to the injection of unescaped HTML code onto the webpage. Consequently, this could result in malicious redirects and site defacements, along with potential phishing attempts. Users are advised to upgrade to PrivateBin version 2.0.2 or higher to prevent exploitation. For those unable to update immediately, implementing recommended Content Security Policies (CSP) or deploying PrivateBin on an isolated domain can serve as temporary measures.

Affected Version(s)

PrivateBin >= 1.7.7, < 2.0.2

References

https://github.com/PrivateBin/PrivateBin/security/advisor...
x_refsource_CONFIRM
https://github.com/PrivateBin/PrivateBin/pull/1550
x_refsource_MISC
https://github.com/PrivateBin/PrivateBin/commit/c4f8482b3...
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.