https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T12:37:37.241272+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-6366 EUVD-2026-6366 2026-10-06T12:37:37.304301+00:00 EUVD-2026-6366 https://cve.radiocsirt.org/vuln/fkie_cve-2024-39899 fkie_cve-2024-39899 2026-10-06T12:37:37.304359+00:00

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication token to the public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they contain the PrivateBin instance, defeating the limit imposed by the proxy. This vulnerability is fixed in 1.7.4.

 https://cve.radiocsirt.org/vuln/ghsa-mqqj-fx8h-437j GHSA-mqqj-fx8h-437j — PrivateBin allows shortening of URLs for other domains 2026-10-06T12:37:37.304432+00:00

Affected: Packagist: privatebin/privatebin

In [v1.5](https://github.com/PrivateBin/PrivateBin/blob/master/CHANGELOG.md#15-2022-12-11) we introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication token to the public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they contain the PrivateBin instance, defeating the limit imposed by the proxy.

Neither the confidentially of existing pastes on the server nor the configuration options including the YOURLs token are affected.

### Impact

This issue only affects non-standard configurations of PrivateBin. Instances are affected if all of the following conditions are met: 1. The PrivateBin instance enables URL shortening. 2. A YOURLs URL shortener is used and it is configured not to be public and require authentication to shorten URLs. 3. A basepath, the YOURLs proxy mechanism and an authentication token is configured in PrivateBin to use the non-public YOURLs instance. 4. A crafted URL is sent to PrivateBins' YOURLs proxy endpoint with a URL that contains the PrivateBin instance URL as a GET-parameter or as part of the URL-fragment, but doesn't start with the instance URL (a third-party URL)

The root cause is, [that the guard clause checking whether the URL to be shortened belongs to your own…