CVE-2026-55891

Name of the Vulnerable Software and Affected Versions PrivateBin versions prior to 2.0.5

Description Reflected JSON injection allows an attacker to return arbitrary data in JSON endpoints, specifically /?jsonld= and /?pasteid. The issue occurs because Request::getRequestUri() in lib/Request.php uses FILTER SANITIZE URL on $ SERVER['REQUEST URI'], which fails to remove quotation marks, angle brackets, or apostrophes. This value is stored in Controller::$ urlBase and subsequently inserted into JSON-LD templates via str replace() in Controller:: jsonld() without proper JSON escaping. An attacker can use a raw quotation mark in the request URI to break out of the JSON string and inject arbitrary key-value data into a CORS-open application/ld+json response. Additionally, the jsonld branch in Controller:: construct() returns before setCacheHeaders(), causing the response to lack critical security headers: X-Content-Type-Options: nosniff, Content Security Policy, X-Frame-Options, and Referrer-Policy. While direct script execution was not demonstrated, manipulated responses can affect structured-data consumers or be exploited by less strict clients.

Recommendations Update PrivateBin to version 2.0.5.