felhom.eu/documentation/audits/security-app-updates-2026-10-27/triage-notes/privatebin.md

privatebin — triage (pin privatebin/pdo:2.0.6)

Template: no gate field; PrivateBin has no login — anyone with the URL can create and read pastes (by design). No custom cfg/conf.php mounted (only /srv/data).

Notices (1 GHSA + 1 release hit)

• GHSA-w873-3ghv-hmh6 (medium, <= 2.0.6, patched 2.1.0): REAL — Markdown HTML keeps class attributes, so a paste can draw a fake Bootstrap modal (phishing). Login: none. Reachable: yes (public subdomain, anyone can create a Markdown paste and send the link).
• release:2.1.0: REAL — the release carrying that fix plus MIME-sniff header fix and comment-file handling fixes. Real 2 / 2.

Fix

Smallest 2.1.0; TARGET privatebin/pdo:2.1.0 (newest stable; Hub tags 2.1.0 / stable / latest). Same main (2): yes. Breaking (read 2.1.0; 2.0.6 baseline): "This release removes the bootstrap (3) template" + jQuery removed. Action only if a custom conf.php sets template = bootstrap or lists bootstrap templates — our template mounts no conf.php (image default config). A viewer's saved template cookie is irrelevant unless template switching is enabled (default off). No data conversion. Lane: SECURITY_FIX. Classifier note: none.