CVE-2026-55696

Deferred Deferred - Pending Action

Cross-Site Scripting in PrivateBin via Malicious Attachment

Publication date: 2026-08-28

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting attachmentLink's href for the Download attachment link. The SVG-only sanitization branch updates only the preview blob, so text/html, image/svg, application/xhtml+xml, and text/xml attachments can remain active in the download blob. On an instance with fileupload = true and a weakened, stripped, or absent Content Security Policy, an anonymous attacker can create such an attachment, and a victim who opens the link in a new tab causes inline JavaScript to execute in the PrivateBin origin. The script can read origin-scoped local storage and issue same-origin requests, including requests to applications co-hosted on the same domain. This issue is fixed in version 2.0.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-09

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-55696

Affected Vendors & Products

Vendor	Product	Version / Range
privatebin	privatebin	to 2.0.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-80	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

Executive Summary

PrivateBin before 2.0.5 has a vulnerability where attacker-controlled MIME types are accepted and used to create same-origin blob URLs for attachments. SVG-only sanitization leaves other dangerous MIME types like text/html active in the download blob. When a victim opens the link in a new tab, inline JavaScript executes in the PrivateBin origin, allowing access to local storage and same-origin requests.

Detection Guidance

To detect this vulnerability, check if your PrivateBin instance is running a version prior to 2.0.5. Use commands like 'curl -s https://your-privatebin-instance/ | grep -i "PrivateBin"' to identify the version. If the version is below 2.0.5, the system is vulnerable.

Impact Analysis

An anonymous attacker could upload a malicious attachment that executes JavaScript in your PrivateBin session when downloaded. This could allow the attacker to read your local storage data or make requests to other applications on the same domain, potentially stealing sensitive information or performing unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. If exploited, it may result in data breaches, leading to legal penalties, reputational damage, and loss of trust in systems handling personal or health information.

Mitigation Strategies

Upgrade PrivateBin to version 2.0.5 or later to address the vulnerability. Ensure Content Security Policy is properly configured to restrict inline scripts and unauthorized content types.

Hi! I’m here to help you understand CVE-2026-55696. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70