CVE-2025-64711
📋 TL;DR
This is a self-XSS vulnerability in PrivateBin where dragging a file with HTML in its filename causes JavaScript execution in the user's own session. It affects macOS/Linux users with file upload enabled who can be tricked into attaching a maliciously named file. Attackers can steal plaintext data or encryption keys before encryption occurs.
💻 Affected Systems
- PrivateBin
📦 What is this software?
Privatebin by Privatebin
⚠️ Risk & Real-World Impact
Worst Case
Attacker steals plaintext pastes, encryption keys, or manipulates UI to exfiltrate sensitive data before encryption, defeating zero-knowledge guarantees for that session.
Likely Case
Limited impact due to requiring user interaction with specific file and OS conditions; most likely used for phishing or UI manipulation if CSP is disabled.
If Mitigated
With CSP enabled and proper user awareness, impact is minimal as HTML injection is blocked and exploitation requires significant user interaction.
🎯 Exploit Status
Exploitation requires convincing user to create/download malicious file and attach it to PrivateBin; payload limited to filename length.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.3
Vendor Advisory: https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-r9x7-7ggj-fx9f
Restart Required: No
Instructions:
1. Backup your PrivateBin instance. 2. Update to version 2.0.3 or later via git pull or package manager. 3. Verify the fix by checking version.
🔧 Temporary Workarounds
Disable file upload
allPrevents exploitation by disabling the vulnerable drag-and-drop file attachment feature.
Edit configuration to set 'fileupload' to false in PrivateBin settings
Enable Content Security Policy
allCSP can block HTML injection attacks even if vulnerability is triggered.
Ensure CSP headers are properly configured in web server
🧯 If You Can't Patch
- Disable file upload functionality in PrivateBin configuration
- Educate users not to drag files from untrusted sources into PrivateBin
🔍 How to Verify
Check if Vulnerable:
Check if PrivateBin version is between 1.7.7 and 2.0.2 and file upload is enabled.Check Version:
Check PrivateBin version in web interface or read VERSION file in installation directory.Verify Fix Applied:
Confirm version is 2.0.3 or later and check commit f9550e5 is present.📡 Detection & Monitoring
Log Indicators:
- Unusual file attachment attempts with special characters in filenames
Network Indicators:
- None specific to this vulnerability
SIEM Query:
Search for file upload events with filenames containing HTML tags or JavaScript patterns.