PrivateBin up to 2.0.2 cfg/conf.php path traversal

Summaryinfo

A vulnerability was found in PrivateBin up to 2.0.2. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the file cfg/conf.php. This manipulation causes path traversal. This vulnerability is registered as CVE-2025-64714. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in PrivateBin up to 2.0.2 and classified as problematic. Affected by this vulnerability is an unknown code block of the file cfg/conf.php. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-23. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. As an impact it is known to affect confidentiality. The summary by CVE is:

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, an unauthenticated Local File Inclusion exists in the template-switching feature. If `templateselection` is enabled in the configuration, the server trusts the `template` cookie and includes the referenced PHP file. An attacker can read sensitive data or, if they manage to drop a PHP file elsewhere, gain remote code execution. The constructed path of the template file is checked for existence, then included. For PrivateBin project files this does not leak any secrets due to data files being created with PHP code that prevents execution, but if a configuration file without that line got created or the visitor figures out the relative path to a PHP script that directly performs an action without appropriate privilege checking, those might execute or leak information. The issue has been patched in version 2.0.3. As a workaround, set `templateselection = false` (which is the default) in `cfg/conf.php` or remove it entirely

The advisory is shared at github.com. This vulnerability is known as CVE-2025-64714 since 11/10/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

By approaching the search of inurl:cfg/conf.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.0.3 eliminates this vulnerability. Applying the patch 4434dbf73ac53217fda0f90d8cf9b6110f8acc4f is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-175312). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• PrivateBin

Version

• 2.0.0
• 2.0.1
• 2.0.2

License

• open-source

Website

• Product: https://github.com/PrivateBin/PrivateBin/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion