{"action":"Upgrade privatebin/privatebin to 2.0.5 or later.","affected":[{"fixed":"2.0.5","introduced":"0"}],"component":"privatebin/privatebin","cve_ids":["CVE-2026-55696"],"ecosystem":"Packagist","epss":0.00368,"exploited":false,"fixed_versions":["2.0.5"],"ghsa_id":"GHSA-f2xf-7x3g-4272","id":"tcs_01M5KF1C0HBXP1PE8Y3S8X2GJZ","modified_at":"2026-08-28T20:40:37.764099Z","published_at":"2026-08-28T20:22:59Z","references":["https://osv.dev/vulnerability/GHSA-f2xf-7x3g-4272","https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-f2xf-7x3g-4272","https://github.com/PrivateBin/PrivateBin/commit/e0dd4c025c19a182b6a4c6fb77a8bf81ceff6899","https://github.com/PrivateBin/PrivateBin","https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.5"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-f2xf-7x3g-4272","url":"https://osv.dev/vulnerability/GHSA-f2xf-7x3g-4272"}],"summary":"PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction"}