CVE-2026-55696: 
PHP vulnerability analysis and mitigation

CVE-2026-55696 is a stored cross-site scripting (XSS) vulnerability in PrivateBin's attachment download link, exploitable via attacker-controlled dangerous MIME types. It affects all PrivateBin versions up to and including 2.0.4 (composer privatebin/privatebin and Docker images privatebin/gcs, privatebin/nginx-fpm-alpine, privatebin/pdo). The vulnerability was reported on June 11, 2026, and publicly disclosed on July 11, 2026, with the GitHub Advisory Database entry updated August 28, 2026. It carries a CVSS v3.1 base score of 4.3 (Moderate) (GitHub Advisory, PrivateBin Advisory).

The vulnerability stems from three compounding root causes in js/privatebin.js (CWE-79, CWE-80). First, DOMPurify sanitization is only triggered for SVG MIME types (/^image\/.*svg/i), leaving text/html, application/xhtml+xml, and text/xml attachments completely unsanitized. Second, the "Download attachment" link's href is set to an unsanitized blob URL at line 3002 — before the SVG sanitization branch — and the SVG branch only reassigns a local variable consumed by the preview, never updating the download link. Third, because PrivateBin uses zero-knowledge encryption, the MIME type is fully attacker-controlled: getAttachmentMimeType simply reads the substring between data: and ; in the decrypted data URI, and the browser creates a same-origin blob: URL with that exact Content-Type. Exploitation requires fileupload = true (non-default) and a weakened, stripped, or absent Content Security Policy; instances using the recommended CSP (script-src 'self') are protected because the blob inherits the policy and blocks inline scripts. This is classified as an incomplete fix of CVE-2022-24833 (PrivateBin Advisory, GitHub Advisory).

A successful exploit allows an anonymous attacker's inline JavaScript to execute in the PrivateBin instance's web origin when a victim opens the malicious "Download attachment" link in a new tab. The script can read origin-scoped localStorage and IndexedDB data, and issue authenticated same-origin HTTP requests to the PrivateBin backend or any application co-hosted on the same domain. PrivateBin itself stores only user preferences (language, template, theme) rather than authentication tokens, so the primary risk is to co-hosted applications that share the same origin. Integrity and availability are not directly impacted (PrivateBin Advisory).

No in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is 0.224% (13th percentile), indicating a low near-term exploitation probability. A detailed proof-of-concept is publicly documented in the security advisory, tested against PrivateBin commit 597a6f0 using a Chromium-based browser. Exploitation requires two non-default conditions: file upload enabled and a weakened or absent CSP, limiting the attack surface to misconfigured self-hosted instances (GitHub Advisory, PrivateBin Advisory).

1. Identify a vulnerable target: Locate a self-hosted PrivateBin instance (version ≤ 2.0.4) with fileupload = true in cfg/conf.php and a weakened, stripped, or absent Content-Security-Policy header.
2. Craft the malicious attachment: Create an HTML file (xss-attachment.html) containing inline JavaScript that reads localStorage, document.cookie, and issues a same-origin fetch() request to exfiltrate data or interact with co-hosted applications.
3. Create the paste: Browse to the target PrivateBin instance, enter decoy text (e.g., "Quarterly report attached. Open the Download attachment link to view it."), attach the HTML file, and click Create. The browser encodes it as data:text/html;base64,... and encrypts it client-side.
4. Distribute the paste URL: Share the resulting paste URL with the intended victim via phishing, social engineering, or any other delivery mechanism.
5. Trigger victim interaction: When the victim opens the paste URL, the page decrypts and renders a "Download attachment" link pointing to a same-origin blob:http://instance/... URL with Content-Type: text/html.
6. Achieve XSS execution: The victim right-clicks or middle-clicks the "Download attachment" link and opens it in a new tab. The browser renders the blob as a full HTML document in the PrivateBin origin, executing the attacker's inline JavaScript with full same-origin access (PrivateBin Advisory, GitHub Advisory).

• Network: Unexpected outbound HTTP requests originating from a victim's browser to attacker-controlled domains shortly after opening a PrivateBin paste; same-origin fetch() calls to the PrivateBin backend (/?jsonld=paste) from a blob: URL context visible in server access logs.
• Logs: Web server access logs showing requests to the PrivateBin instance from a blob: referrer or with unusual Origin headers; paste creation events with text/html, image/svg, application/xhtml+xml, or text/xml MIME types in the attachment data (visible if logging is enabled).
• File System: Presence of PrivateBin paste data files containing base64-encoded HTML payloads with embedded <script> tags in the configured data directory (e.g., data/ for Filesystem model).
• Browser: A new browser tab opening at a blob:http://<privatebin-instance>/... URL that renders an unexpected HTML page rather than triggering a file download (PrivateBin Advisory).

Upgrade to PrivateBin version 2.0.5, which resolves this vulnerability by replacing the attacker-controlled MIME type with application/octet-stream for the download link blob, forcing the browser to download rather than render the file. An allowlist of safe MIME types (non-SVG images, video, audio, PDF, text/plain) is used to preserve legitimate preview functionality. As an interim workaround for instances that cannot immediately upgrade, enforce the recommended Content-Security-Policy header (script-src 'self' 'wasm-unsafe-eval'), which blocks inline script execution in the blob context. Additionally, disabling file upload (fileupload = false) eliminates the attack vector entirely (PrivateBin Advisory, Release v2.0.5, Patch Commit).

The vulnerability was reported by security researcher Rizky Muhammad (@EvidentObscurity) and credited in the official advisory. The PrivateBin maintainers (rugk as remediation developer, elrido as reviewer) responded promptly, reproducing the issue within two days of the report and releasing a patch in version 2.0.5 on July 11, 2026. The advisory explicitly frames this as an incomplete fix of the prior CVE-2022-24833, acknowledging that the original fix's safety argument for the download link was flawed. The release received positive community reactions on GitHub (PrivateBin Advisory, Release v2.0.5).