XSS Vulnerability in PrivateBin Affects File Upload Functionality

CVE-2025-64711

What is CVE-2025-64711?

PrivateBin, a zero-knowledge online pastebin service, has a vulnerability that affects file upload functionality in versions 1.7.7 to 2.0.2. This vulnerability allows attackers to exploit users' sessions through crafted file names containing HTML. When a user drags a maliciously named file into the system, arbitrary JavaScript can be executed within their own session (self-XSS). This can lead to the exfiltration of sensitive data such as plaintext and encryption keys. The issue arises specifically for macOS and Linux users due to how the > character functions in file names. To be susceptible, users must also have file upload features enabled on their PrivateBin instance. The vulnerability can be mitigated by updating to version 2.0.3, which addresses the issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References