PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users
Date: 2025-11
Affected: composer/privatebin/privatebin
Attack vector: xss
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2025-64711
CWE: CWE-79
CVSS: 3.9 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)

## Summary Dragging a file whose filename contains HTML is reflected verbatim into the page via the drag-and-drop helper, so any user who drops a crafted file on PrivateBin will execute arbitrary JavaScript within their own session (self-XSS). This allows an attacker who can entice a victim to drag or otherwise attach such a file to exfiltrate plaintext, encryption keys, or stored pastes before they are encrypted or sent. **Note 1:** as the malicious filename must contain the `>` character, the victim must not be using Windows for this to work, since this OS simply forbids this character in filenames. **Note 2:** most PrivateBin instances use the Content-Security-Policy header to prevent most use-cases of this vulnerability. This report will describe the impact as if this header had been disabled by the PrivateBin instance owner. ## Affected versions PrivateBin versions since 1.7.7 and before 2.0.3. ## Conditions * Only macIOS or Linux users are affected, due to the way the `>` character is treated in a file name on Windows. * The PrivateBIn instance needs to have file upload enabled. * An attacker needs to have access to the local file system or somehow convince the user to create (or download) a malicious file (name). * An attacker needs to convince the user to attach that malicious file to PrivateBin. ## Impact Any Mac / Linux user who can be tricked into dragging a maliciously named file into the editor is impacted; code runs in the origin of the PrivateBin insta


Mitigations:

Architectural layers (MAESTRO):