New
Release v2.0.2 - Fix HTML injection/XSS vulnerability in filenames of attached files
- CHANGED: Upgrading libraries to: DOMpurify 3.3.0
- CHANGED: Refactored jQuery DOM element creation into plain JavaScript
- FIXED: Sanitize file name in attachment size hint (CVE-2025-62796 / https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-867c-p784-5q6g)
- FIXED: PHP OPcache module is optional again (#1679)
- FIXED: bootstrap template password peek input group display
This release addresses an issue with the lacking sanitation of file names when displaying attached files. This issue affects instances that enable fileupload. More details on this issue can be found in the security advisory.