Update privatebin to 2.0.3 (#4044)

This commit is contained in:
Alexander L. 2025-11-13 17:02:44 +01:00 committed by GitHub
parent 00065533a5
commit 039b0a5cf6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 7 additions and 7 deletions

View File

@ -8,7 +8,7 @@ services:
PROXY_AUTH_ADD: "false"
server:
image: privatebin/nginx-fpm-alpine:2.0.2@sha256:2342f6a587291529d425ce242a2c69ed3a87b2056d924a85ab0ac4b7e1aa8297
image: privatebin/nginx-fpm-alpine:2.0.3@sha256:f8fcca3d71dfe983c8404dc6dbcc140ab12cebe8d4ee62329254c79b5934b1e8
user: "1000:1000"
read_only: true
restart: on-failure

View File

@ -3,7 +3,7 @@ id: privatebin
name: PrivateBin
tagline: A minimalist, open source online pastebin
category: files
version: "2.0.2"
version: "2.0.3"
port: 3070
description: >-
⚠️ PrivateBin requires HTTPS and exposure to the public internet to work. The easiest way to do this is with the Cloudflare Tunnel app or Nginx Proxy Manager app on the Umbrel App Store.
@ -51,13 +51,13 @@ gallery:
- 3.jpg
- 4.jpg
releaseNotes: >-
🚨 This release addresses a security issue with file name sanitation when displaying attached files. This affects instances that enable file upload.
🚨 This release addresses critical security issues including arbitrary file inclusion and file name sanitation vulnerabilities.
Key improvements in this release:
- Fixed security issue with file name sanitation in attachments
- Fixed password peek display issue
- Improved compatibility by making PHP OPcache module optional
Key security fixes in this release:
- Fixed arbitrary file inclusion vulnerability when template switching is enabled
- Fixed file name sanitation issue that could allow malicious filenames to be used for HTML injection
- Fixed issue with creating new pastes from cloned ones when JSON files are attached
Full release notes can be found at https://github.com/PrivateBin/PrivateBin/releases