{"id":"CVE-2026-55696","title":"PrivateBin is an online pastebin where the server has zero knowledge of pasted data","summary":"PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobU…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cwe":["CWE-79","CWE-80"],"vendor":"privatebin","product":"privatebin/privatebin","affected":["privatebin/privatebin <= 2.0.4"],"patched":["privatebin/privatebin 2.0.5"],"published":"2026-08-28","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55696","references":[{"url":"https://github.com/PrivateBin/PrivateBin/commit/7f1f40853efe0eb12db9cc4a30ea8524ac00f423","label":"security-advisories@github.com"},{"url":"https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.5","label":"security-advisories@github.com"},{"url":"https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-f2xf-7x3g-4272","label":"security-advisories@github.com"},{"url":"https://github.com/PrivateBin/PrivateBin/commit/e0dd4c025c19a182b6a4c6fb77a8bf81ceff6899"},{"url":"https://github.com/advisories/GHSA-f2xf-7x3g-4272"}],"tags":["nvd","ghsa","composer"],"epss":0.00224,"epssPercentile":0.13287,"aliases":["GHSA-f2xf-7x3g-4272"],"ecosystem":"composer","ingestedAt":"2026-08-28T20:24:59.724Z","slug":"CVE-2026-55696","body":"## Overview\n\nPrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting attachmentLink's href for the Download attachment link. The SVG-only sanitization branch updates only the preview blob, so text/html, image/svg, application/xhtml+xml, and text/xml attachments can remain active in the download blob. On an instance with fileupload = true and a weakened, stripped, or absent Content Security Policy, an anonymous attacker can create such an attachment, and a victim who opens the link in a new tab causes inline JavaScript to execute in the PrivateBin origin. The script can read origin-scoped local storage and issue same-origin requests, including requests to applications co-hosted on the same domain. This issue is fixed in version 2.0.5.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55696)\n\nAffected packages:\n\n- `privatebin/privatebin <= 2.0.4`\n\nPatched in:\n\n- `privatebin/privatebin 2.0.5`\n\nSource: https://github.com/advisories/GHSA-f2xf-7x3g-4272","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}