CVE-2020-5223mediumCWE-79

CVE-2020-5223: medium-severity vulnerability in PrivateBin

Persistent XSS vulnerability in filename of attached file in PrivateBin

Published · Updated

Follow this CVE+ Monitor PrivateBin+ Monitor privatebin/privatebin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.7%
In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3.2 & v1.2.2. Admins are urged to upgrade to these versions to protect the affected users.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
Affected products
PrivateBin · PrivateBin
Related CVEs — PrivateBin

In the same product, most dangerous first.

CVE-2022-24833HIGHPersistent Cross-site Scripting (XSS) vulnerability in PrivateBinEPSS 1.4%CVE-2024-39899MEDIUMPrivateBin allows shortening of URLs for other domainsEPSS 0.6%CVE-2026-55891NONEPrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URIEPSS 0.5%CVE-2025-64714MEDIUMPrivateBin's template-switching feature allows arbitrary local file inclusion through path traversalEPSS 0.5%CVE-2026-55696MEDIUMPrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interactionEPSS 0.4%CVE-2025-62796MEDIUMPrivateBin persistent HTML injection in attachment filename enables redirect and defacementEPSS 0.3%