• FIXED: Prevent arbitrary PHP file inclusion when enabling template switching (CVE-2025-64714)
• FIXED: Malicious filename can be used for self-XSS / HTML injection locally for users (CVE-2025-64711)
• FIXED: Unable to create a new paste from the cloned one when a JSON file attached (#1585)

This release addresses issues with arbitrary PHP file inclusion when enabling template switching and lacking sanitation of file names when drag-&-dropping files into PrivateBin with malicious filenames. More details on this issue can be found in the security advisories:

• Template-switching feature allowing arbitrary local file inclusion through path traversal
• Malicious filename can be used for self-XSS / HTML injection locally for users