PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction (CVE-2026-55696)

The vulnerability in PrivateBin (CVE-2026-55696) is a stored XSS in the attachment download link caused by unsanitized blobs with attacker-controlled MIME types, specifically text/html or image/svg. The sanitization logic only applies to inline previews of SVG attachments but not to the download link, which always points to an unsanitized blob URL. Since the MIME type is extracted from attacker-controlled decrypted data, an attacker can craft a paste with a malicious HTML attachment. When a victim opens the download link in a new tab, the browser renders the blob as a same-origin document, executing the attacker's inline JavaScript with full same-origin privileges. This bypasses protections intended by the fix for CVE-2022-24833, which only sanitized inline previews and assumed the download link would be handled as a file download rather than a same-origin blob navigation. The vulnerability requires fileupload=true (non-default) and a weakened or absent CSP. Instances using the recommended CSP are not vulnerable.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the PrivateBin instance's origin when a victim opens the malicious attachment download link in a new tab. This can lead to theft of cookies, localStorage data, and same-origin fetch requests, potentially compromising user session data or other sensitive information accessible within the PrivateBin origin. The impact is limited by the requirement of user interaction (opening the download link in a new tab) and the presence of a weakened or absent CSP. Confidentiality is partially impacted; integrity and availability are not directly affected.

A patch is available that addresses this vulnerability. Users should upgrade PrivateBin to version 2.0.5 or later. Additionally, enforcing the default recommended Content-Security-Policy (CSP) protects against this attack by blocking inline script execution in blob URLs. Instances with fileupload enabled should ensure CSP is properly configured and not weakened or removed. Since the vulnerability requires fileupload=true (non-default), disabling file uploads if not needed also mitigates risk.