CVE-2025-62796
BaseFortify
Publication date: 2025-10-28
Last updated on: 2025-10-30
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| privatebin | privatebin | 1.7.7 |
| privatebin | privatebin | 2.0.2 |
| privatebin | privatebin | 2.0.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-80 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in PrivateBin versions 1.7.7 through 2.0.1 allows an attacker to perform persistent HTML injection via the unsanitized attachment filename (attachment_name) when attachments are enabled. The attacker can modify the attachment_name before encryption so that after decryption, arbitrary HTML is inserted unescaped into the page near the file size hint. This can enable redirects (such as meta refresh), site defacement, and phishing attacks. The vulnerability was introduced in version 1.7.7 and fixed in 2.0.2.
How can this vulnerability impact me? :
The vulnerability can lead to site defacement, phishing attacks, and redirects by injecting arbitrary HTML into the page. Although script execution is normally blocked by the recommended Content Security Policy (CSP), the injected HTML can still be used for malicious purposes such as redirecting users to malicious sites or displaying misleading content. This impacts the integrity and trustworthiness of the site but does not affect confidentiality or availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update PrivateBin to version 2.0.2 or later. Alternatively, you can enforce the recommended Content Security Policy (CSP), deploy PrivateBin on a separate domain, or disable attachments to prevent exploitation.