Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| privatebin/privatebin | composer | >= 1.7.7, < 2.0.3 | 2.0.3 |
Miggo AIRoot Cause AnalysisThe vulnerability is a local file inclusion (LFI) in PrivateBin's template-switching feature, identified as CVE-2025-64714. The flaw was introduced in version 1.7.7 (commit 44f8cfbfb8df4b4bec1cbf79aa8ce51abdb18be3) and fixed in version 2.0.3 (commit 4434dbf73ac53217fda0f90d8cf9b6110f8acc4f).
The root cause lies in the PrivateBin\TemplateSwitcher::isTemplateAvailable function. When the templateselection option is enabled, this function trusts user input from the template cookie. The vulnerable code path retrieves the cookie value via PrivateBin\TemplateSwitcher::getSelectedByUserTemplate, constructs a file path using PrivateBin\View::getTemplateFilePath, and then uses file_exists() to check for the template. Because the cookie value is not sanitized, an attacker can use path traversal sequences (e.g., ../) to check for the existence of arbitrary PHP files on the server.
If the file exists, the application proceeds to include it using include $path; within the PrivateBin\View::draw function, resulting in the execution of the specified local PHP file. The patch resolves this by using basename() on the cookie input to strip directory traversal characters and by removing the dangerous file_exists() check, instead relying on a strict allowlist of templates.
