CVE-2026-55696 PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction
An attacker can inject malicious scripts via attachment MIME types, allowing code execution in the victim's browser if file uploads are enabled and CSP is weak.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55696?
CVE-2026-55696 is a medium-severity cross-site scripting vulnerability in PrivateBin, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting attachmentLink's href for the Download attachment link. The SVG-only sanitization branch updates only the preview blob, so text/html, image/svg, application/xhtml+xml, and text/xml attachments can remain active in the download blob. On an instance with fileupload = true and a weakened, stripped, or absent Content Security Policy, an anonymous attacker can create such an attachment, and a victim who opens the link in a new tab causes inline JavaScript to execute in the PrivateBin origin. The script can read origin-scoped local storage and issue same-origin requests, including requests to applications co-hosted on the same domain. This issue is fixed in version 2.0.5.
Which versions are affected by CVE-2026-55696?
2 open source packages ship an affected version, including privatebin/privatebin.
| Package | Affected | Fixed in |
|---|---|---|
privatebin/privatebin Packagist | All versions | 2.0.5 |
privatebin/privatebin Packagist | All versions | 2.0.5 |
How do I fix CVE-2026-55696?
Upgrade privatebin/privatebin to 2.0.5 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-55696 being exploited?
There is no known exploitation of CVE-2026-55696 in the wild and no public exploit code.
Sources
Also known as GHSA-f2xf-7x3g-4272.