CVE-2025-64714: 
PHP vulnerability analysis and mitigation

CVE-2025-64714 is a Local File Inclusion (LFI) vulnerability discovered in PrivateBin's template-switching feature. The vulnerability affects PrivateBin versions since 1.7.7 up to version 2.0.3, where it was patched. When the templateselection feature is enabled in the configuration, the server trusts the template cookie and includes the referenced PHP file without proper validation, potentially allowing an unauthenticated attacker to read sensitive data or achieve Remote Code Execution (RCE) under specific conditions (GitHub Advisory, Miggo).

The vulnerability exists in the template-switching feature's implementation where the TemplateSwitcher::isTemplateAvailable method blindly trusts user input from the template cookie. The vulnerability is triggered when a visitor sets a cookie template pointing to an existing PHP file without its suffix, using a path relative to the tpl folder. The CVSS score is 5.8 (Moderate) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. The vulnerability is tracked as CWE-23 (Relative Path Traversal), CWE-73 (External Control of File Name or Path), and CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) (GitHub Advisory).

The vulnerability allows an attacker to read sensitive data through local file inclusion. While PrivateBin's project files are protected by default due to PHP protection lines that prevent execution, if a configuration file lacks this protection or if an attacker can identify the relative path to a PHP script without proper privilege checking, information could be leaked or code execution might be possible. Analysis of real-world impact revealed 11 instances with the template switcher enabled, though none had unprotected configuration files (GitHub Advisory).

The vulnerability has been patched in PrivateBin version 2.0.3. For users unable to update immediately, a workaround is available by setting templateselection = false in cfg/conf.php or removing it entirely, as its default value is false. The patch implements proper input validation and prevents directory traversal attempts (GitHub Advisory).