Threats tagged 'ghsa-g2j9-g8r5-rg82'

PrivateBin versions from 1.7.7 up to but not including 2.0.3 have a Local File Inclusion vulnerability in the template-switching feature when the 'templateselection' option is enabled. This flaw allows an unauthenticated attacker to include arbitrary local PHP files by manipulating the 'template' cookie, potentially exposing sensitive data or enabling remote code execution if malicious PHP files are present on the server. However, the default PrivateBin configuration protects critical files with a PHP execution prevention line, limiting the impact. No full remote code execution or denial of service has been confirmed. A patch is available in version 2.0.3.