{"id":"CVE-2026-55891","aliases":["EUVD-2026-67940","GHSA-xrjc-c68j-hp7w"],"status":"published","title":"PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI","description":"PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri() in lib/Request.php passes $_SERVER['REQUEST_URI'] through FILTER_SANITIZE_URL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::_init() stores the attacker-controlled value in Controller::$_urlBase. Controller::_jsonld() in lib/Controller.php then uses str_replace() to insert that value without JSON escaping into js/types.jsonld, js/paste.jsonld, and the other JSON-LD templates used by /?jsonld= and /?pasteid. A raw quotation mark delivered by an HTTP client, proxy, or structured-data crawler that does not normalize the request target can break out of the JSON string and inject arbitrary key-value data into a CORS-open application/ld+json response. The jsonld branch in Controller::__construct() returns before _setCacheHeaders(), so the response also lacks X-Content-Type-Options: nosniff, Content Security Policy, X-Frame-Options, and Referrer-Policy. Direct script execution was not demonstrated, but manipulated responses can affect structured-data consumers or combine with less strict clients. This issue is fixed in version 2.0.5.","severity":{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00539,"percentile":0.45865,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116"],"published":"2026-08-28T20:23:50Z","modified":"2026-10-28T02:30:38Z","fixes":[{"ecosystem":"Packagist","package":"privatebin/privatebin","fixed_in":["2.0.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"privatebin/privatebin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.4"},{"fixed":"2.0.5"}]}]},{"source":"osv","ecosystem":"Packagist","package":"privatebin/privatebin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5"}]}],"versions":["1.0","1.1","1.1.1","1.2","1.2.1","1.2.2","1.2.3","1.3","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0","1.5.0","1.5.1","1.5.2","1.6.0","1.6.1","1.6.2","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4"]}],"products":[{"vendor":"privatebin","product":"privatebin"}],"references":[{"url":"https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-xrjc-c68j-hp7w","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/PrivateBin/PrivateBin/commit/164c839c39688533ef0086575878e8392cd21249","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.5","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/PrivateBin/PrivateBin/commit/75f056dcda955d94c17ec5a4f8c54a9b7bfcee07","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xrjc-c68j-hp7w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55891.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55891","tags":["advisory"]},{"url":"https://github.com/PrivateBin/PrivateBin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-55891","title":"PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI","description":"PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri() in lib/Request.php passes $_SERVER['REQUEST_URI'] through FILTER_SANITIZE_URL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::_init() stores the attacker-controlled value in Controller::$_urlBase. Controller::_jsonld() in lib/Controller.php then uses str_replace() to insert that value without JSON escaping into js/types.jsonld, js/paste.jsonld, and the other JSON-LD templates used by /?jsonld= and /?pasteid. A raw quotation mark delivered by an HTTP client, proxy, or structured-data crawler that does not normalize the request target can break out of the JSON string and inject arbitrary key-value data into a CORS-open application/ld+json response. The jsonld branch in Controller::__construct() returns before _setCacheHeaders(), so the response also lacks X-Content-Type-Options: nosniff, Content Security Policy, X-Frame-Options, and Referrer-Policy. Direct script execution was not demonstrated, but manipulated responses can affect structured-data consumers or combine with less strict clients. This issue is fixed in version 2.0.5.","status":"published","published":"2026-08-28T20:23:50.477Z","modified":"2026-08-31T18:47:39.096Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none","assessor":"cna"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:20:12.260247Z"}],"euvd":[{"id":"EUVD-2026-67940","description":"PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri() in lib/Request.php passes $_SERVER['REQUEST_URI'] through FILTER_SANITIZE_URL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::_init() stores the attacker-controlled value in Controller::$_urlBase. Controller::_jsonld() in lib/Controller.php then uses str_replace() to insert that value without JSON escaping into js/types.jsonld, js/paste.jsonld, and the other JSON-LD templates used by /?jsonld= and /?pasteid. A raw quotation mark delivered by an HTTP client, proxy, or structured-data crawler that does not normalize the request target can break out of the JSON string and inject arbitrary key-value data into a CORS-open application/ld+json response. The jsonld branch in Controller::__construct() returns before _setCacheHeaders(), so the response also lacks X-Content-Type-Options: nosniff, Content Security Policy, X-Frame-Options, and Referrer-Policy. Direct script execution was not demonstrated, but manipulated responses can affect structured-data consumers or combine with less strict clients. This issue is fixed in version 2.0.5.","status":"published","published":"2026-08-28T20:23:50Z","modified":"2026-08-31T18:47:39Z","updated_at":"2026-11-02T18:01:20.215322Z"}],"ghsa":[{"id":"GHSA-xrjc-c68j-hp7w","title":"PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI","description":"## Vulnerability Details\n\nA reflected JSON injection allows an attacker to return arbitrary data in the JSON endpoints (like ` /?jsonld=` and `/?pasteid`).\n\n### Root Cause\n\n`Request::getRequestUri()` sanitizes `$_SERVER['REQUEST_URI']` with `FILTER_SANITIZE_URL`:\n\n```php\npublic function getRequestUri()\n{\n    $uri = array_key_exists('REQUEST_URI', $_SERVER) ? filter_var($_SERVER['REQUEST_URI'], FILTER_SANITIZE_URL) : '';\n    return empty($uri) ? '/' : $uri;\n}\n```\n\n`FILTER_SANITIZE_URL` does **not** strip `\"`, `'`, `\u003c`, `\u003e` characters (per the PHP manual's allowed-character list for this filter). So the raw, attacker-controlled request URI (including query string) passes through almost unmodified into `Controller::$_urlBase` (set in `_init()`).\n\nIn `Controller::_jsonld()`, `$_urlBase` is spliced directly into one of the static `.jsonld` templates (`js/types.jsonld`, `js/paste.jsonld`, etc.) with a plain `str_replace()`, without any JSON-escaping:\n\n```php\n$content = str_replace(\n    '?jsonld=',\n    $this-\u003e_urlBase . '?jsonld=',\n    file_get_contents($file)\n);\n...\nheader('Content-type: application/ld+json');\nheader('Access-Control-Allow-Origin: *');\nheader('Access-Control-Allow-Methods: GET');\necho $content;\n```\n\nA request URI containing a literal `\"` therefore breaks out of the JSON string in the `\"@context\".\"pb\"` value and injects arbitrary attacker-controlled key/value pairs into the response body, which is served with `Content-Type: application/ld+json` and `Access-Control-Allow-Origin: *`.\n\nAdditionally, the `jsonld` case in `Controller::__construct()` returns early:\n\n```php\ncase 'jsonld':\n    $this-\u003e_jsonld($this-\u003e_request-\u003egetParam('jsonld'));\n    return;\n```\n\nThis bypasses `_setCacheHeaders()` and all of the security headers normally applied in `_view()` (notably `X-Content-Type-Options: nosniff`, CSP, `X-Frame-Options`, `Referrer-Policy`). So this is the only response path lacking `X-Content-Type-Options: nosniff`.\n\n### Attack Scenario\n1. An attacker crafts a request to the target PrivateBin instance whose request-target contains a raw `\"` character, e.g.:\n   `GET /?jsonld=types\u0026x=\"injected\":\"pwned\",\"y\":\" HTTP/1.1`\n   (delivered via a raw socket / HTTP client that doesn't normalize the request line — most browsers percent-encode `\"` in the address bar, but many HTTP libraries, proxies, and automated link-preview/structured-data crawlers do not).\n2. The server reflects the raw value into the JSON-LD response, producing a syntactically broken / attacker-extended JSON document.\n3. Because `Access-Control-Allow-Origin: *` is set and `X-Content-Type-Options: nosniff` is missing on this path, any origin can fetch and rely on this manipulated content, and the response loses the defense-in-depth MIME-sniffing protection applied everywhere else in the app.\n\n### Impact\nReflected, unauthenticated injection of attacker-controlled content into a CORS-open `application/ld+json` response, plus a missing `X-Content-Type-Options: nosniff` header on this single response path (present everywhere else). No direct script execution was demonstrated on current browsers (this content type is generally not HTML-sniffed), but it is a real output-encoding bug (CWE-116) and a defense-in-depth gap that could be exploited by structured-data consumers or in combination with other issues / less-strict clients.\n\n### Vulnerable Code\n```php\n$content = str_replace(\n    '?jsonld=',\n    $this-\u003e_urlBase . '?jsonld=',\n    file_get_contents($file)\n);\n...\nheader('Content-type: application/ld+json');\n```\n\n### Verification\nDynamically confirmed on v2.0.4 (commit `597a6f0`) via `php -S 127.0.0.1:8082 index.php`:\n\nRequest:\n```http\nGET /?jsonld=types\u0026x=\"injected\":\"pwned\",\"y\":\" HTTP/1.1\nHost: 127.0.0.1:8082\nConnection: close\n```\n\nUnpatched response body (excerpt):\n```json\n\"pb\": \"/?jsonld=types\u0026x=\"injected\":\"pwned\",\"y\":\"?jsonld=types#\"\n```\n— i.e. the `\"` characters are reflected raw, breaking the JSON structure, and `X-Content-Type-Options` is absent from the response headers.\n\nAfter applying the fix above, the same request returns:\n```json\n\"pb\": \"/?jsonld=types\u0026x=\\\"injected\\\":\\\"pwned\\\",\\\"y\\\":\\\"?jsonld=types#\"\n```\nwith `X-Content-Type-Options: nosniff` present, and the existing `JsonApiTest::testJsonLd*` unit test expectations (`/?jsonld=...`) remain unchanged for normal requests.\n\n## Credits\n\nThis vulnerability was reported by Iaohkut, @alanturing881, which PrivateBin would like to thank for that.\nIn general, PrivateBin would like to thank everyone reporting issues and potential vulnerabilities to it.\n\nIf you think you have found a vulnerability or potential security risk, [we'd kindly ask you to follow our security policy](https://github.com/PrivateBin/PrivateBin/blob/master/SECURITY.md) and report it to us. PrivateBin then assess the report and will take the actions PrivateBin deem necessary to address it.","status":"published","published":"2026-08-28T20:25:34Z","modified":"2026-08-28T20:25:35Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:41:08.084849Z"}],"nvd":[{"id":"CVE-2026-55891","description":"PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri() in lib/Request.php passes $_SERVER['REQUEST_URI'] through FILTER_SANITIZE_URL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::_init() stores the attacker-controlled value in Controller::$_urlBase. Controller::_jsonld() in lib/Controller.php then uses str_replace() to insert that value without JSON escaping into js/types.jsonld, js/paste.jsonld, and the other JSON-LD templates used by /?jsonld= and /?pasteid. A raw quotation mark delivered by an HTTP client, proxy, or structured-data crawler that does not normalize the request target can break out of the JSON string and inject arbitrary key-value data into a CORS-open application/ld+json response. The jsonld branch in Controller::__construct() returns before _setCacheHeaders(), so the response also lacks X-Content-Type-Options: nosniff, Content Security Policy, X-Frame-Options, and Referrer-Policy. Direct script execution was not demonstrated, but manipulated responses can affect structured-data consumers or combine with less strict clients. This issue is fixed in version 2.0.5.","status":"published","published":"2026-08-28T22:16:51.957Z","modified":"2026-09-09T21:09:13.08Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none","assessor":"secondary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:12:42.366888Z"}],"osv":[{"id":"CVE-2026-55891","title":"PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI","description":"PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri() in lib/Request.php passes $_SERVER['REQUEST_URI'] through FILTER_SANITIZE_URL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::_init() stores the attacker-controlled value in Controller::$_urlBase. Controller::_jsonld() in lib/Controller.php then uses str_replace() to insert that value without JSON escaping into js/types.jsonld, js/paste.jsonld, and the other JSON-LD templates used by /?jsonld= and /?pasteid. A raw quotation mark delivered by an HTTP client, proxy, or structured-data crawler that does not normalize the request target can break out of the JSON string and inject arbitrary key-value data into a CORS-open application/ld+json response. The jsonld branch in Controller::__construct() returns before _setCacheHeaders(), so the response also lacks X-Content-Type-Options: nosniff, Content Security Policy, X-Frame-Options, and Referrer-Policy. Direct script execution was not demonstrated, but manipulated responses can affect structured-data consumers or combine with less strict clients. This issue is fixed in version 2.0.5.","status":"published","published":"2026-08-28T20:23:50.477Z","modified":"2026-10-28T02:30:38.346265473Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:45:11.609219Z"},{"id":"GHSA-xrjc-c68j-hp7w","title":"PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI","description":"## Vulnerability Details\n\nA reflected JSON injection allows an attacker to return arbitrary data in the JSON endpoints (like ` /?jsonld=` and `/?pasteid`).\n\n### Root Cause\n\n`Request::getRequestUri()` sanitizes `$_SERVER['REQUEST_URI']` with `FILTER_SANITIZE_URL`:\n\n```php\npublic function getRequestUri()\n{\n    $uri = array_key_exists('REQUEST_URI', $_SERVER) ? filter_var($_SERVER['REQUEST_URI'], FILTER_SANITIZE_URL) : '';\n    return empty($uri) ? '/' : $uri;\n}\n```\n\n`FILTER_SANITIZE_URL` does **not** strip `\"`, `'`, `\u003c`, `\u003e` characters (per the PHP manual's allowed-character list for this filter). So the raw, attacker-controlled request URI (including query string) passes through almost unmodified into `Controller::$_urlBase` (set in `_init()`).\n\nIn `Controller::_jsonld()`, `$_urlBase` is spliced directly into one of the static `.jsonld` templates (`js/types.jsonld`, `js/paste.jsonld`, etc.) with a plain `str_replace()`, without any JSON-escaping:\n\n```php\n$content = str_replace(\n    '?jsonld=',\n    $this-\u003e_urlBase . '?jsonld=',\n    file_get_contents($file)\n);\n...\nheader('Content-type: application/ld+json');\nheader('Access-Control-Allow-Origin: *');\nheader('Access-Control-Allow-Methods: GET');\necho $content;\n```\n\nA request URI containing a literal `\"` therefore breaks out of the JSON string in the `\"@context\".\"pb\"` value and injects arbitrary attacker-controlled key/value pairs into the response body, which is served with `Content-Type: application/ld+json` and `Access-Control-Allow-Origin: *`.\n\nAdditionally, the `jsonld` case in `Controller::__construct()` returns early:\n\n```php\ncase 'jsonld':\n    $this-\u003e_jsonld($this-\u003e_request-\u003egetParam('jsonld'));\n    return;\n```\n\nThis bypasses `_setCacheHeaders()` and all of the security headers normally applied in `_view()` (notably `X-Content-Type-Options: nosniff`, CSP, `X-Frame-Options`, `Referrer-Policy`). So this is the only response path lacking `X-Content-Type-Options: nosniff`.\n\n### Attack Scenario\n1. An attacker crafts a request to the target PrivateBin instance whose request-target contains a raw `\"` character, e.g.:\n   `GET /?jsonld=types\u0026x=\"injected\":\"pwned\",\"y\":\" HTTP/1.1`\n   (delivered via a raw socket / HTTP client that doesn't normalize the request line — most browsers percent-encode `\"` in the address bar, but many HTTP libraries, proxies, and automated link-preview/structured-data crawlers do not).\n2. The server reflects the raw value into the JSON-LD response, producing a syntactically broken / attacker-extended JSON document.\n3. Because `Access-Control-Allow-Origin: *` is set and `X-Content-Type-Options: nosniff` is missing on this path, any origin can fetch and rely on this manipulated content, and the response loses the defense-in-depth MIME-sniffing protection applied everywhere else in the app.\n\n### Impact\nReflected, unauthenticated injection of attacker-controlled content into a CORS-open `application/ld+json` response, plus a missing `X-Content-Type-Options: nosniff` header on this single response path (present everywhere else). No direct script execution was demonstrated on current browsers (this content type is generally not HTML-sniffed), but it is a real output-encoding bug (CWE-116) and a defense-in-depth gap that could be exploited by structured-data consumers or in combination with other issues / less-strict clients.\n\n### Vulnerable Code\n```php\n$content = str_replace(\n    '?jsonld=',\n    $this-\u003e_urlBase . '?jsonld=',\n    file_get_contents($file)\n);\n...\nheader('Content-type: application/ld+json');\n```\n\n### Verification\nDynamically confirmed on v2.0.4 (commit `597a6f0`) via `php -S 127.0.0.1:8082 index.php`:\n\nRequest:\n```http\nGET /?jsonld=types\u0026x=\"injected\":\"pwned\",\"y\":\" HTTP/1.1\nHost: 127.0.0.1:8082\nConnection: close\n```\n\nUnpatched response body (excerpt):\n```json\n\"pb\": \"/?jsonld=types\u0026x=\"injected\":\"pwned\",\"y\":\"?jsonld=types#\"\n```\n— i.e. the `\"` characters are reflected raw, breaking the JSON structure, and `X-Content-Type-Options` is absent from the response headers.\n\nAfter applying the fix above, the same request returns:\n```json\n\"pb\": \"/?jsonld=types\u0026x=\\\"injected\\\":\\\"pwned\\\",\\\"y\\\":\\\"?jsonld=types#\"\n```\nwith `X-Content-Type-Options: nosniff` present, and the existing `JsonApiTest::testJsonLd*` unit test expectations (`/?jsonld=...`) remain unchanged for normal requests.\n\n## Credits\n\nThis vulnerability was reported by Iaohkut, @alanturing881, which PrivateBin would like to thank for that.\nIn general, PrivateBin would like to thank everyone reporting issues and potential vulnerabilities to it.\n\nIf you think you have found a vulnerability or potential security risk, [we'd kindly ask you to follow our security policy](https://github.com/PrivateBin/PrivateBin/blob/master/SECURITY.md) and report it to us. PrivateBin then assess the report and will take the actions PrivateBin deem necessary to address it.","status":"published","published":"2026-08-28T20:25:34Z","modified":"2026-08-28T20:40:37.666522Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","level":"none"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:47:00.198893Z"}]}}