Local File Inclusion Vulnerability in PrivateBin by PrivateBin
CVE-2025-64714

5.8MEDIUM

Key Information:

Vendor

Privatebin

Status
Privatebin
Vendor
CVE Published:
13 November 2025

What is CVE-2025-64714?

A vulnerability exists in PrivateBin's template-switching feature, allowing unauthenticated Local File Inclusion if the 'templateselection' feature is enabled. The server trusts the 'template' cookie, which can lead to execution of referenced PHP files. Although the system is designed to prevent leaking sensitive data due to specific safeguards, insecure configurations or exposure to certain PHP scripts could allow attackers to access confidential information or execute arbitrary code. To mitigate risks, users should update to version 2.0.3 or disable 'templateselection' in their configuration.

Affected Version(s)

PrivateBin >= 1.7.7, < 2.0.3

References

https://github.com/PrivateBin/PrivateBin/security/advisor...
x_refsource_CONFIRM
https://github.com/PrivateBin/PrivateBin/commit/4434dbf73...
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-64714 : Local File Inclusion Vulnerability in PrivateBin by PrivateBin