XSS Vulnerability in PrivateBin Affects File Upload Functionality
CVE-2025-64711

3.9LOW

Key Information:

Vendor

Privatebin

Status
Privatebin
Vendor
CVE Published:
13 November 2025

What is CVE-2025-64711?

PrivateBin, a zero-knowledge online pastebin service, has a vulnerability that affects file upload functionality in versions 1.7.7 to 2.0.2. This vulnerability allows attackers to exploit users' sessions through crafted file names containing HTML. When a user drags a maliciously named file into the system, arbitrary JavaScript can be executed within their own session (self-XSS). This can lead to the exfiltration of sensitive data such as plaintext and encryption keys. The issue arises specifically for macOS and Linux users due to how the > character functions in file names. To be susceptible, users must also have file upload features enabled on their PrivateBin instance. The vulnerability can be mitigated by updating to version 2.0.3, which addresses the issue.

Affected Version(s)

PrivateBin >= 1.7.7, < 2.0.3

References

https://github.com/PrivateBin/PrivateBin/security/advisor...
x_refsource_CONFIRM
https://github.com/PrivateBin/PrivateBin/commit/f9550e513...
x_refsource_MISC

CVSS V3.1

Score:
3.9
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.