CVE-2025-64711: PrivateBin XSS Vulnerability

CVE-2025-64711 Overview

PrivateBin is a zero-knowledge online pastebin. Versions 1.7.7 through 2.0.2 contain a self-inflicted cross-site scripting (self-XSS) flaw in the drag-and-drop file attachment feature. The client-side helper reflects a dropped file's name into the DOM as raw HTML. A victim who drags a file with HTML in its name into the editor executes arbitrary JavaScript within their own PrivateBin session.

The issue affects only macOS and Linux users because Windows disallows the > character in filenames. The vulnerability is tracked as [CWE-79] and patched in version 2.0.3.

Critical Impact
When Content-Security-Policy is disabled, an attacker who convinces a macOS or Linux user to drop a maliciously named file can exfiltrate plaintext, passphrases, or encryption keys before data is encrypted, defeating PrivateBin's zero-knowledge guarantee for that session.

Affected Products

PrivateBin versions 1.7.7 through 2.0.2
Deployments on macOS and Linux clients (Windows clients are not affected)
Instances with file upload enabled

Discovery Timeline

2025-11-13 - CVE-2025-64711 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64711

Vulnerability Analysis

The flaw lives in the printDragAndDropFileNames function in js/privatebin.js. When a user drags a file into the PrivateBin editor, the helper joins filename strings and injects them into the DOM using jQuery's .html() method. Because .html() parses its input as HTML, any markup contained in the filename is rendered and executed in the origin of the PrivateBin instance.

Exploitation is bounded by user interaction. The victim must be tricked into obtaining a file with an HTML payload in its name and dragging it onto the paste editor. Code executes only in the victim's own session, so the flaw is neither persistent nor remotely triggerable without user cooperation.

If the site enforces a strict Content-Security-Policy (CSP), inline script execution is blocked and the impact degrades to HTML injection, enabling phishing lures or redirects. Without CSP, the injected script can read cleartext content and encryption keys before PrivateBin performs client-side encryption, breaking the zero-knowledge property for the affected session.

Root Cause

The root cause is unsanitized reflection of user-controlled data. The filename array is passed directly to $dragAndDropFileNames.html(fileNames.join('<br>')) without HTML-encoding, allowing filename contents to be interpreted as markup [CWE-79].

Attack Vector

The attacker crafts or delivers a file whose name contains an HTML payload such as <img src=x onerror=...>.txt. The victim, using macOS or Linux, must attach that file to a PrivateBin paste via drag-and-drop or the file picker. On drop, the payload renders and executes in the PrivateBin origin.

javascript

// Patch applied in js/privatebin.js
// Before (vulnerable): filenames rendered as HTML
// $dragAndDropFileNames.html(fileNames.join('<br>'));

// After (fixed): filenames appended as text nodes
function printDragAndDropFileNames(fileNames) {
    $dragAndDropFileNames.empty();
    fileNames.forEach(fileName => {
        const name = document.createTextNode(fileName);
        $dragAndDropFileNames[0].appendChild(name);
        $dragAndDropFileNames[0].appendChild(document.createElement('br'));
    });
}
// Source: https://github.com/PrivateBin/PrivateBin/commit/f9550e513381208b36595ee2404e968144bba78b

Detection Methods for CVE-2025-64711

Indicators of Compromise

Files with HTML metacharacters such as <, >, ", or onerror= embedded in filenames appearing in browser downloads or file shares on macOS and Linux hosts.
Browser console errors or CSP violation reports originating from the PrivateBin origin that reference inline script execution.
Outbound requests from the PrivateBin browser tab to unexpected domains immediately after a file attachment event.

Detection Strategies

Inspect deployed PrivateBin instances for versions between 1.7.7 and 2.0.2 by checking lib/Configuration.php Subresource Integrity hashes against the patched js/privatebin.js hash from the PrivateBin patch commit.
Enable and monitor CSP violation reporting on the PrivateBin origin to surface attempted script injections.
Correlate web-proxy or endpoint telemetry to identify users receiving files whose names contain HTML tags.

Monitoring Recommendations

Alert on downloads or email attachments whose filenames contain <script, onerror=, or <img sequences on macOS and Linux endpoints.
Log and review the Content-Security-Policy-Report-Only or enforced CSP endpoints on hosted PrivateBin instances.
Track PrivateBin release announcements and verify the deployed version reports 2.0.3 or later.

How to Mitigate CVE-2025-64711

Immediate Actions Required

Upgrade PrivateBin to version 2.0.3 or later on every self-hosted instance.
Verify the served js/privatebin.js matches the patched SRI hash published in lib/Configuration.php.
Ensure a strict Content-Security-Policy is enforced and not weakened by custom configuration.

Patch Information

The fix replaces the vulnerable .html() call with DOM text-node construction, so filenames can no longer be parsed as markup. Details are in the PrivateBin GitHub Security Advisory GHSA-r9x7-7ggj-fx9f and the remediation commit.

Workarounds

Keep the default strict Content-Security-Policy enabled; this reduces impact to HTML injection only.
Disable file upload in the PrivateBin configuration if upgrading immediately is not possible.
Instruct macOS and Linux users to avoid attaching files received from untrusted sources until the instance is patched.

bash

# Disable attachments in cfg/conf.php until patched
[main]
fileupload = false

# Verify installed version after upgrade
grep -R "'VERSION'" lib/Controller.php