Vulnerability-Lookup

GHSA-XRJC-C68J-HP7W

Vulnerability from github – Published: 2026-08-28 20:25 – Updated: 2026-08-28 20:25

Summary

PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI

Details

Vulnerability Details

A reflected JSON injection allows an attacker to return arbitrary data in the JSON endpoints (like /?jsonld= and /?pasteid).

Root Cause

Request::getRequestUri() sanitizes $_SERVER['REQUEST_URI'] with FILTER_SANITIZE_URL:

public function getRequestUri()
{
    $uri = array_key_exists('REQUEST_URI', $_SERVER) ? filter_var($_SERVER['REQUEST_URI'], FILTER_SANITIZE_URL) : '';
    return empty($uri) ? '/' : $uri;
}

FILTER_SANITIZE_URL does not strip ", ', <, > characters (per the PHP manual's allowed-character list for this filter). So the raw, attacker-controlled request URI (including query string) passes through almost unmodified into Controller::$_urlBase (set in _init()).

In Controller::_jsonld(), $_urlBase is spliced directly into one of the static .jsonld templates (js/types.jsonld, js/paste.jsonld, etc.) with a plain str_replace(), without any JSON-escaping:

$content = str_replace(
    '?jsonld=',
    $this->_urlBase . '?jsonld=',
    file_get_contents($file)
);
...
header('Content-type: application/ld+json');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET');
echo $content;

A request URI containing a literal " therefore breaks out of the JSON string in the "@context"."pb" value and injects arbitrary attacker-controlled key/value pairs into the response body, which is served with Content-Type: application/ld+json and Access-Control-Allow-Origin: *.

Additionally, the jsonld case in Controller::__construct() returns early:

case 'jsonld':
    $this->_jsonld($this->_request->getParam('jsonld'));
    return;

This bypasses _setCacheHeaders() and all of the security headers normally applied in _view() (notably X-Content-Type-Options: nosniff, CSP, X-Frame-Options, Referrer-Policy). So this is the only response path lacking X-Content-Type-Options: nosniff.

Attack Scenario

An attacker crafts a request to the target PrivateBin instance whose request-target contains a raw " character, e.g.: GET /?jsonld=types&x="injected":"pwned","y":" HTTP/1.1 (delivered via a raw socket / HTTP client that doesn't normalize the request line — most browsers percent-encode " in the address bar, but many HTTP libraries, proxies, and automated link-preview/structured-data crawlers do not).
The server reflects the raw value into the JSON-LD response, producing a syntactically broken / attacker-extended JSON document.
Because Access-Control-Allow-Origin: * is set and X-Content-Type-Options: nosniff is missing on this path, any origin can fetch and rely on this manipulated content, and the response loses the defense-in-depth MIME-sniffing protection applied everywhere else in the app.

Impact

Reflected, unauthenticated injection of attacker-controlled content into a CORS-open application/ld+json response, plus a missing X-Content-Type-Options: nosniff header on this single response path (present everywhere else). No direct script execution was demonstrated on current browsers (this content type is generally not HTML-sniffed), but it is a real output-encoding bug (CWE-116) and a defense-in-depth gap that could be exploited by structured-data consumers or in combination with other issues / less-strict clients.

Vulnerable Code

$content = str_replace(
    '?jsonld=',
    $this->_urlBase . '?jsonld=',
    file_get_contents($file)
);
...
header('Content-type: application/ld+json');

Verification

Dynamically confirmed on v2.0.4 (commit 597a6f0) via php -S 127.0.0.1:8082 index.php:

Request:

GET /?jsonld=types&x="injected":"pwned","y":" HTTP/1.1
Host: 127.0.0.1:8082
Connection: close

Unpatched response body (excerpt):

"pb": "/?jsonld=types&x="injected":"pwned","y":"?jsonld=types#"

— i.e. the " characters are reflected raw, breaking the JSON structure, and X-Content-Type-Options is absent from the response headers.

After applying the fix above, the same request returns:

"pb": "/?jsonld=types&x=\"injected\":\"pwned\",\"y\":\"?jsonld=types#"

with X-Content-Type-Options: nosniff present, and the existing JsonApiTest::testJsonLd* unit test expectations (/?jsonld=...) remain unchanged for normal requests.

Credits

This vulnerability was reported by Iaohkut, @alanturing881, which PrivateBin would like to thank for that. In general, PrivateBin would like to thank everyone reporting issues and potential vulnerabilities to it.

If you think you have found a vulnerability or potential security risk, we'd kindly ask you to follow our security policy and report it to us. PrivateBin then assess the report and will take the actions PrivateBin deem necessary to address it.

Severity

0.0 (None)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "privatebin/privatebin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55891"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-116"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T20:25:34Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Vulnerability Details\n\nA reflected JSON injection allows an attacker to return arbitrary data in the JSON endpoints (like ` /?jsonld=` and `/?pasteid`).\n\n### Root Cause\n\n`Request::getRequestUri()` sanitizes `$_SERVER[\u0027REQUEST_URI\u0027]` with `FILTER_SANITIZE_URL`:\n\n```php\npublic function getRequestUri()\n{\n    $uri = array_key_exists(\u0027REQUEST_URI\u0027, $_SERVER) ? filter_var($_SERVER[\u0027REQUEST_URI\u0027], FILTER_SANITIZE_URL) : \u0027\u0027;\n    return empty($uri) ? \u0027/\u0027 : $uri;\n}\n```\n\n`FILTER_SANITIZE_URL` does **not** strip `\"`, `\u0027`, `\u003c`, `\u003e` characters (per the PHP manual\u0027s allowed-character list for this filter). So the raw, attacker-controlled request URI (including query string) passes through almost unmodified into `Controller::$_urlBase` (set in `_init()`).\n\nIn `Controller::_jsonld()`, `$_urlBase` is spliced directly into one of the static `.jsonld` templates (`js/types.jsonld`, `js/paste.jsonld`, etc.) with a plain `str_replace()`, without any JSON-escaping:\n\n```php\n$content = str_replace(\n    \u0027?jsonld=\u0027,\n    $this-\u003e_urlBase . \u0027?jsonld=\u0027,\n    file_get_contents($file)\n);\n...\nheader(\u0027Content-type: application/ld+json\u0027);\nheader(\u0027Access-Control-Allow-Origin: *\u0027);\nheader(\u0027Access-Control-Allow-Methods: GET\u0027);\necho $content;\n```\n\nA request URI containing a literal `\"` therefore breaks out of the JSON string in the `\"@context\".\"pb\"` value and injects arbitrary attacker-controlled key/value pairs into the response body, which is served with `Content-Type: application/ld+json` and `Access-Control-Allow-Origin: *`.\n\nAdditionally, the `jsonld` case in `Controller::__construct()` returns early:\n\n```php\ncase \u0027jsonld\u0027:\n    $this-\u003e_jsonld($this-\u003e_request-\u003egetParam(\u0027jsonld\u0027));\n    return;\n```\n\nThis bypasses `_setCacheHeaders()` and all of the security headers normally applied in `_view()` (notably `X-Content-Type-Options: nosniff`, CSP, `X-Frame-Options`, `Referrer-Policy`). So this is the only response path lacking `X-Content-Type-Options: nosniff`.\n\n### Attack Scenario\n1. An attacker crafts a request to the target PrivateBin instance whose request-target contains a raw `\"` character, e.g.:\n   `GET /?jsonld=types\u0026x=\"injected\":\"pwned\",\"y\":\" HTTP/1.1`\n   (delivered via a raw socket / HTTP client that doesn\u0027t normalize the request line \u2014 most browsers percent-encode `\"` in the address bar, but many HTTP libraries, proxies, and automated link-preview/structured-data crawlers do not).\n2. The server reflects the raw value into the JSON-LD response, producing a syntactically broken / attacker-extended JSON document.\n3. Because `Access-Control-Allow-Origin: *` is set and `X-Content-Type-Options: nosniff` is missing on this path, any origin can fetch and rely on this manipulated content, and the response loses the defense-in-depth MIME-sniffing protection applied everywhere else in the app.\n\n### Impact\nReflected, unauthenticated injection of attacker-controlled content into a CORS-open `application/ld+json` response, plus a missing `X-Content-Type-Options: nosniff` header on this single response path (present everywhere else). No direct script execution was demonstrated on current browsers (this content type is generally not HTML-sniffed), but it is a real output-encoding bug (CWE-116) and a defense-in-depth gap that could be exploited by structured-data consumers or in combination with other issues / less-strict clients.\n\n### Vulnerable Code\n```php\n$content = str_replace(\n    \u0027?jsonld=\u0027,\n    $this-\u003e_urlBase . \u0027?jsonld=\u0027,\n    file_get_contents($file)\n);\n...\nheader(\u0027Content-type: application/ld+json\u0027);\n```\n\n### Verification\nDynamically confirmed on v2.0.4 (commit `597a6f0`) via `php -S 127.0.0.1:8082 index.php`:\n\nRequest:\n```http\nGET /?jsonld=types\u0026x=\"injected\":\"pwned\",\"y\":\" HTTP/1.1\nHost: 127.0.0.1:8082\nConnection: close\n```\n\nUnpatched response body (excerpt):\n```json\n\"pb\": \"/?jsonld=types\u0026x=\"injected\":\"pwned\",\"y\":\"?jsonld=types#\"\n```\n\u2014 i.e. the `\"` characters are reflected raw, breaking the JSON structure, and `X-Content-Type-Options` is absent from the response headers.\n\nAfter applying the fix above, the same request returns:\n```json\n\"pb\": \"/?jsonld=types\u0026x=\\\"injected\\\":\\\"pwned\\\",\\\"y\\\":\\\"?jsonld=types#\"\n```\nwith `X-Content-Type-Options: nosniff` present, and the existing `JsonApiTest::testJsonLd*` unit test expectations (`/?jsonld=...`) remain unchanged for normal requests.\n\n## Credits\n\nThis vulnerability was reported by Iaohkut, @alanturing881, which PrivateBin would like to thank for that.\nIn general, PrivateBin would like to thank everyone reporting issues and potential vulnerabilities to it.\n\nIf you think you have found a vulnerability or potential security risk, [we\u0027d kindly ask you to follow our security policy](https://github.com/PrivateBin/PrivateBin/blob/master/SECURITY.md) and report it to us. PrivateBin then assess the report and will take the actions PrivateBin deem necessary to address it.",
  "id": "GHSA-xrjc-c68j-hp7w",
  "modified": "2026-08-28T20:25:34Z",
  "published": "2026-08-28T20:25:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-xrjc-c68j-hp7w"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PrivateBin/PrivateBin/commit/75f056dcda955d94c17ec5a4f8c54a9b7bfcee07"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/PrivateBin/PrivateBin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI"
}

CVE-2026-55891 (GCVE-0-2026-55891)

Vulnerability from cvelistv5 – Published: 2026-08-28 20:23 – Updated: 2026-08-28 20:23

Title

PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI

Summary

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri() in lib/Request.php passes $_SERVER['REQUEST_URI'] through FILTER_SANITIZE_URL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::_init() stores the attacker-controlled value in Controller::$_urlBase. Controller::_jsonld() in lib/Controller.php then uses str_replace() to insert that value without JSON escaping into js/types.jsonld, js/paste.jsonld, and the other JSON-LD templates used by /?jsonld= and /?pasteid. A raw quotation mark delivered by an HTTP client, proxy, or structured-data crawler that does not normalize the request target can break out of the JSON string and inject arbitrary key-value data into a CORS-open application/ld+json response. The jsonld branch in Controller::__construct() returns before _setCacheHeaders(), so the response also lacks X-Content-Type-Options: nosniff, Content Security Policy, X-Frame-Options, and Referrer-Policy. Direct script execution was not demonstrated, but manipulated responses can affect structured-data consumers or combine with less strict clients. This issue is fixed in version 2.0.5.

Severity

0 (None)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

CWE

CWE-116 - Improper Encoding or Escaping of Output

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/PrivateBin/PrivateBin/security…	x_refsource_CONFIRM
https://github.com/PrivateBin/PrivateBin/commit/1…	x_refsource_MISC
https://github.com/PrivateBin/PrivateBin/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
PrivateBin	PrivateBin	Affected: < 2.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "PrivateBin",
          "vendor": "PrivateBin",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri() in lib/Request.php passes $_SERVER[\u0027REQUEST_URI\u0027] through FILTER_SANITIZE_URL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::_init() stores the attacker-controlled value in Controller::$_urlBase. Controller::_jsonld() in lib/Controller.php then uses str_replace() to insert that value without JSON escaping into js/types.jsonld, js/paste.jsonld, and the other JSON-LD templates used by /?jsonld= and /?pasteid. A raw quotation mark delivered by an HTTP client, proxy, or structured-data crawler that does not normalize the request target can break out of the JSON string and inject arbitrary key-value data into a CORS-open application/ld+json response. The jsonld branch in Controller::__construct() returns before _setCacheHeaders(), so the response also lacks X-Content-Type-Options: nosniff, Content Security Policy, X-Frame-Options, and Referrer-Policy. Direct script execution was not demonstrated, but manipulated responses can affect structured-data consumers or combine with less strict clients. This issue is fixed in version 2.0.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 0,
            "baseSeverity": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T20:23:50.477Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-xrjc-c68j-hp7w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-xrjc-c68j-hp7w"
        },
        {
          "name": "https://github.com/PrivateBin/PrivateBin/commit/164c839c39688533ef0086575878e8392cd21249",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PrivateBin/PrivateBin/commit/164c839c39688533ef0086575878e8392cd21249"
        },
        {
          "name": "https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/PrivateBin/PrivateBin/releases/tag/2.0.5"
        }
      ],
      "source": {
        "advisory": "GHSA-xrjc-c68j-hp7w",
        "discovery": "UNKNOWN"
      },
      "title": "PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55891",
    "datePublished": "2026-08-28T20:23:50.477Z",
    "dateReserved": "2026-06-17T16:59:42.760Z",
    "dateUpdated": "2026-08-28T20:23:50.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted