PrivateBin stores pasted data only in the client session, but prior to version 2.0.5 the JavaScript that builds the attachment download link did not validate the attached MIME type. An attacker can embed a payload in a malicious MIME type such as text/html, image/svg or application/xhtml+xml. When a user clicks the generated download link, the browser creates a same‑origin blob containing the untrusted content and the browser then executes any inline JavaScript that the blob lives in the PrivateBin origin. The script can read the browser’s local storage and send same‑origin requests, which may expose session data or enable further attacks against co‑hosted applications. This is a classic client‑side XSS flaw that gives the attacker execution privileges in the victim’s browser within the PrivateBin domain.

The flaw exists in all PrivateBin instances running a version older than 2.0.5, provided the server configuration allows file uploads (fileupload = true) and does not enforce a restrictive Content Security Policy. The CNA vendor is PrivateBin and the affected product is PrivateBin; the vulnerability is fixed in release 2.0.5.

The CVSS score of 4.3 indicates a moderate severity. Exploitation requires the attacker to upload a crafted attachment and a victim to interact by clicking the download link, but any user of the affected instance can be targeted. An attacker can use the XSS to exfiltrate data or hijack user sessions. The risk is further heightened when a weak or absent Content Security Policy is in place. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation yet, but the potential for damage remains if hosts run vulnerable PrivateBin versions.