CVE-2026-55696

Name of the Vulnerable Software and Affected Versions PrivateBin versions prior to 2.0.5

Description Stored cross-site scripting (XSS) exists in the attachment download link. An anonymous attacker can create a paste with a malicious attachment (such as text/html, image/svg, application/xhtml+xml, or text/xml) that bypasses sanitization. In js/privatebin.js, the function AttachmentViewer.setAttachment() uses getAttachmentMimeType to accept attacker-controlled MIME types and getBlobUrl to create a same-origin blob. While an SVG-only sanitization branch exists, it only updates the preview blob and not the download link's href attribute.

On instances where fileupload is set to true and the Content Security Policy (CSP) is weakened, stripped, or absent, a victim opening the download link in a new tab will trigger the execution of inline JavaScript within the PrivateBin origin. This allows the script to read origin-scoped local storage and issue same-origin requests to the backend or other applications co-hosted on the same domain.

Recommendations Update PrivateBin to version 2.0.5. As a temporary mitigation, set fileupload = false in the configuration. Ensure the recommended Content Security Policy (CSP) is strictly enforced to block inline scripts.