CVE-2025-62796: 
PHP vulnerability analysis and mitigation

CVE-2025-62796 is a persistent Cross-Site Scripting (XSS) vulnerability in PrivateBin versions greater than 1.7.7 and before 2.0.2. The vulnerability was discovered on October 23, 2025, and publicly disclosed on October 28, 2025. The issue affects the HTML sanitization of attached filenames in the file size hint feature, potentially enabling persistent XSS, defacement, and open redirect attacks (GitHub Advisory).

The vulnerability stems from improper neutralization of user-controllable input in the attachment_name field. When a file is attached, the filename is included in the cipherMessage object that the client encrypts, but is later rendered in the DOM without proper HTML escaping. The vulnerability has been assigned a CVSS v3.1 score of 5.8 (Moderate) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) (GitHub Advisory).

The vulnerability allows attackers to inject arbitrary HTML into the filename displayed near the file size hint when attachments are enabled. While the default Content Security Policy (CSP) prevents inline script execution, the vulnerability can still be exploited for various attacks including website defacement, phishing through redirection to malicious websites, and potential attacks on other services hosted on the same domain. In deployments with misconfigured CSP or lacking client protection, the vulnerability could potentially compromise the confidentiality of the PrivateBin instance (GitHub Advisory).

The primary mitigation is to upgrade to PrivateBin version 2.0.2 or later, which includes the patch. Alternative workarounds include updating the CSP configuration to the latest recommended settings, deploying PrivateBin on a separate domain to limit the vulnerability scope, or disabling attachments entirely. The fix was implemented in commit c4f8482, which addresses the HTML sanitization issue (GitHub Advisory).