CVE-2026-55891: 
PHP vulnerability analysis and mitigation

CVE-2026-55891 is a reflected JSON injection vulnerability in PrivateBin, an online pastebin service with zero server-side knowledge of pasted data. The flaw affects all versions up to and including 2.0.4 (composer privatebin/privatebin and Docker images privatebin/gcs, privatebin/nginx-fpm-alpine, and privatebin/pdo). It was reported on 2026-06-15, disclosed publicly on 2026-07-11, and patched in version 2.0.5 released the same day. The CVSS v3.1 base score is 0.0 (Low/None as formally scored), though Feedly estimates the category as HIGH due to the CORS-open nature of the affected endpoint (GitHub Advisory, Github Advisory).

The root cause is improper output encoding (CWE-116): Request::getRequestUri() in lib/Request.php sanitizes $_SERVER['REQUEST_URI'] using PHP's FILTER_SANITIZE_URL, which does not strip quotation marks ("), apostrophes ('), or angle brackets (<, >). The sanitized, attacker-controlled URI is stored in Controller::$_urlBase and then inserted verbatim into JSON-LD template files (js/types.jsonld, js/paste.jsonld, etc.) via a plain str_replace() call in Controller::_jsonld(), with no JSON escaping applied. A raw " character in the request URI breaks out of the JSON string context, allowing injection of arbitrary key-value pairs into the application/ld+json response served with Access-Control-Allow-Origin: *. Compounding the issue, the jsonld branch in Controller::__construct() returns early, bypassing _setCacheHeaders() and omitting security headers including X-Content-Type-Options: nosniff, CSP, X-Frame-Options, and Referrer-Policy (GitHub Advisory, Github Advisory).

The vulnerability enables unauthenticated, reflected injection of attacker-controlled content into CORS-open application/ld+json responses accessible from any origin. While direct script execution in modern browsers was not demonstrated (the content type is generally not HTML-sniffed), the manipulated responses can affect structured-data consumers, search engine crawlers, and link-preview services that process JSON-LD, and could be chained with other vulnerabilities or less-strict HTTP clients for further exploitation. The absence of X-Content-Type-Options: nosniff on this specific response path removes a defense-in-depth protection present on all other PrivateBin endpoints (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported. The EPSS score is 0.328% (25th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an HTTP client, proxy, or crawler that does not percent-encode quotation marks in the request URI — most modern browsers normalize these characters, limiting the practical attack surface to raw HTTP clients, automated crawlers, and certain proxy configurations (Github Advisory).

1. Identify target: Locate a PrivateBin instance running version 2.0.4 or earlier that exposes the /?jsonld= endpoint publicly.
2. Craft malicious request: Using a raw HTTP client or tool that does not normalize/percent-encode quotation marks (e.g., netcat, curl with --path-as-is, or a custom script), construct a GET request with a " character in the query string:

   GET /?jsonld=types&x="injected":"pwned","y":" HTTP/1.1
   Host: <target>
   Connection: close

3. Send the request: Deliver the crafted request directly to the server. The FILTER_SANITIZE_URL filter passes the raw " characters through unchanged.
4. Observe injection: The server reflects the unescaped URI into the JSON-LD response body, breaking out of the "pb" JSON string and inserting attacker-controlled key-value pairs into the application/ld+json document.
5. Leverage CORS exposure: Since the response includes Access-Control-Allow-Origin: * and lacks X-Content-Type-Options: nosniff, any cross-origin client or structured-data consumer can fetch and act on the manipulated JSON-LD content (GitHub Advisory).

• Network: HTTP GET requests to /?jsonld= or /?pasteid= endpoints containing unencoded quotation mark characters (") in the query string; requests originating from automated HTTP clients or crawlers rather than standard browsers.
• Logs: Web server access logs showing requests to /?jsonld=types or similar endpoints with raw " characters in the request URI (e.g., GET /?jsonld=types&x="injected":"pwned").
• Response Anomalies: JSON-LD responses from the server containing unexpected key-value pairs not present in the static template files (js/types.jsonld, js/paste.jsonld); responses to /?jsonld= endpoints missing the X-Content-Type-Options: nosniff header on unpatched instances.

Upgrade to PrivateBin version 2.0.5, which fixes the vulnerability by modifying Request::getRequestUri() to return only the URL path component via parse_url($uri, PHP_URL_PATH), stripping query parameters (including any injected characters) before the value is stored in Controller::$_urlBase. The fix also adds the missing X-Content-Type-Options: nosniff header to the JSON-LD response path. All affected package variants should be updated: composer privatebin/privatebin and Docker images privatebin/gcs, privatebin/nginx-fpm-alpine, and privatebin/pdo (PrivateBin Release, Patch Commit).

The vulnerability was reported by researcher Iaohkut (@alanturing881) from NightWolf Team via GitHub Security Advisory on 2026-06-15 and was reviewed and patched within one day. The PrivateBin maintainers (elrido as remediation developer, rugk as analyst) acknowledged and credited the reporter. The release of version 2.0.5 received positive community reactions on GitHub. No significant broader media coverage or notable external researcher commentary has been identified (GitHub Advisory, PrivateBin Release).