CVE-2026-55696: PrivateBin XSS Vulnerability

CVE-2026-55696 Overview

CVE-2026-55696 is a stored cross-site scripting (XSS) vulnerability in PrivateBin, a zero-knowledge online pastebin. Versions prior to 2.0.5 allow an anonymous attacker to upload attachments with attacker-controlled MIME types such as text/html, image/svg, application/xhtml+xml, and text/xml. When a victim opens the download link in a new tab, inline JavaScript executes in the PrivateBin origin. The script can read origin-scoped local storage and issue same-origin requests to co-hosted applications. Exploitation requires fileupload = true and a weakened, stripped, or absent Content Security Policy (CSP). The issue is fixed in version 2.0.5 and classified under [CWE-79].

Critical Impact
An anonymous attacker can execute arbitrary JavaScript in the PrivateBin origin, exposing origin-scoped local storage and enabling same-origin requests to co-hosted applications.

Affected Products

PrivateBin versions prior to 2.0.5
Instances configured with fileupload = true
Instances with a weakened, stripped, or absent Content Security Policy

Discovery Timeline

2026-08-28 - CVE-2026-55696 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55696

Vulnerability Analysis

The vulnerability resides in AttachmentViewer.setAttachment within js/privatebin.js. The function calls getAttachmentMimeType to derive the MIME type from attacker-controlled attachment data. It then passes that MIME type to getBlobUrl, which creates a same-origin blob URL used as the href for the attachmentLink download element.

PrivateBin includes an SVG-only sanitization branch, but that branch updates only the preview blob. The download blob retains the raw attacker-controlled content and MIME type. When a victim opens the download link in a new tab, the browser renders the attachment inline using the attacker-supplied MIME type. Inline JavaScript then executes under the PrivateBin origin.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The download blob accepts renderable MIME types including text/html, image/svg, application/xhtml+xml, and text/xml without forcing a non-executable content disposition. Sanitization is limited to the preview path, leaving the download path unprotected.

Attack Vector

An anonymous attacker uploads a paste with a malicious attachment carrying an executable MIME type. The attacker shares the paste URL with a victim. If the victim opens the download link in a new browser tab, the malicious payload executes in the PrivateBin origin. The script can then read origin-scoped localStorage, issue same-origin fetch calls, and pivot to other applications co-hosted on the same domain. Exploitation depends on the instance running with fileupload = true and lacking a strict CSP.

javascript

            const mimeType = me.getAttachmentMimeType(attachmentData);

+            // We explicitly do _not_ use the original mime type for the download link
+            // to always force a download instead of potentially dangerous browser rendering/parsing/interpretation
+            let safeMimeType = 'application/octet-stream';
+            if (me.isSafeMimeType(mimeType)) {
+                safeMimeType = mimeType;
+            }
+
            // extract data and convert to binary
            const rawData = attachmentData.substring(base64Start);
            const decodedData = rawData.length > 0 ? atob(rawData) : '';

-            let blobUrl = getBlobUrl(decodedData, mimeType);
+            let blobUrl = getBlobUrl(decodedData, safeMimeType);
            attachmentLink.attr('href', blobUrl);

Source: PrivateBin commit 7f1f4085. The patch replaces the attacker-controlled MIME type with application/octet-stream unless the type is verified safe via isSafeMimeType, forcing browsers to download rather than render the attachment.

Detection Methods for CVE-2026-55696

Indicators of Compromise

Uploaded attachments declaring MIME types of text/html, image/svg, application/xhtml+xml, or text/xml
Blob URLs (blob: scheme) opened in new tabs shortly after visiting PrivateBin paste URLs
Unexpected same-origin requests originating from PrivateBin blob contexts targeting co-hosted applications
Access patterns to localStorage keys used by PrivateBin or neighboring applications on the same origin

Detection Strategies

Inspect PrivateBin data storage for attachments containing HTML, SVG <script> elements, or XHTML with embedded JavaScript
Monitor web server logs for uploads of attachments with executable MIME types followed by paste retrievals from separate IP addresses
Compare deployed js/privatebin.js file integrity against the version 2.0.5 SRI hash sha512-LgKu4erWrsmN7bYLwo1I2cptFa+RUY33oufmu0Psdp2vmGA4SAqA7sml0kIFCP/44Yd4VILvr/4fCRVSQ48GNQ==

Monitoring Recommendations

Enable CSP reporting endpoints to catch inline script violations on the PrivateBin origin
Alert on JavaScript execution in blob contexts issuing fetch calls to co-hosted API paths
Track the PrivateBin configuration state, specifically the fileupload flag, and audit any changes to CSP response headers

How to Mitigate CVE-2026-55696

Immediate Actions Required

Upgrade PrivateBin to version 2.0.5 or later, which forces application/octet-stream for unsafe attachment MIME types
Set fileupload = false in cfg/conf.php until the upgrade is completed if attachment support is not required
Restore or strengthen the default Content Security Policy shipped with PrivateBin and remove any reverse-proxy rules that strip CSP headers

Patch Information

The fix is available in PrivateBin Release 2.0.5 and details are documented in GitHub Security Advisory GHSA-f2xf-7x3g-4272. The commit 7f1f4085 introduces an isSafeMimeType allowlist and defaults the download blob to application/octet-stream.

Workarounds

Host PrivateBin on a dedicated origin with no co-tenant applications to limit lateral same-origin abuse
Deploy a strict CSP that disallows inline script execution, blob script sources, and restricts default-src to 'self'
Disable file uploads by setting fileupload = false in the PrivateBin configuration

bash

# /srv/privatebin/cfg/conf.php
[main]
fileupload = false

# Nginx CSP hardening example
add_header Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;