CVE-2026-55696
CVE-2026-55696 · PrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting attachmentLink's href for the Download attachment link. The SVG-only sanitization branch updates only the preview blob, so text/html, image/svg, application/xhtml+xml, and text/xml attachments can remain active in the download blob. On an instance with fileupload = true and a weakened, stripped, or absent Content Security Policy, an anonymous attacker can create such an attachment, and a victim who opens the link in a new tab causes inline JavaScript to execute in the PrivateBin origin. The script can read origin-scoped local storage and issue same-origin requests, including requests to applications co-hosted on the same domain. This issue is fixed in version 2.0.5.
CVSS 4.3 · Mittel · EPSS 0,4% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: php
Betroffene Produkte und Versionen
privatebin
- Softwareversionen
- < 2.0.5: Betroffen
Keine Korrektur veröffentlicht
privatebin/privatebin Packagist
- Softwareversionen
- 1.0
- 1.1
- 1.1.1
- 1.2
- 1.2.1
- 1.2.2
- 1.2.3
- 1.3
- 1.3.1
- 1.3.2
- 1.3.3
- 1.3.4
- 1.3.5
- 1.4.0
- 1.5.0
- 1.5.1
- 1.5.2
- 1.6.0
- 1.6.1
- 1.6.2
- 1.7.0
- 1.7.1
- 1.7.2
- 1.7.3
- 1.7.4
- 1.7.5
- 1.7.6
- 1.7.7
- 1.7.8
- 1.7.9
- 2.0.0
- 2.0.1
- 2.0.2
- 2.0.3
- 2.0.4
- Betroffene Versionsbereiche
- ECOSYSTEM: < 2.0.5
Auf 2.0.5 aktualisieren