Skip to content
OpenAdvisories
Medium · 6.3 CVE-2026-68511 EUVD-2026-124052

Paaster: TOCTOU race condition defeats the 'burn after reading' guarantee on view-once pastes

Published Nov 11, 2026 · Updated Nov 13, 2026 · Assigned by GitHub_M

Description

Paaster is a pastebin application. Prior to version 3.3.0, Paaster's "view once" (burn-after-reading) paste mode can be bypassed with concurrent requests. The check that's supposed to enforce single-use is a plain read followed by a separate write, with no atomicity, so multiple simultaneous requests can all see the paste as "not yet read" and all successfully retrieve it. This issue has been patched in version 3.3.0.

Affected products

VendorProductAffectedFixed
WardPearce paaster < 3.3.0 —

References