PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI (CVE-2026-55891)

The vulnerability in PrivateBin (CVE-2026-55891) is a reflected JSON injection caused by improper sanitization of the REQUEST_URI. The method getRequestUri() uses PHP's FILTER_SANITIZE_URL, which does not remove characters such as double quotes. This unsanitized URI is then inserted directly into JSON-LD template files via str_replace without JSON escaping, allowing an attacker to inject arbitrary key/value pairs into the JSON response. The affected response is served with 'Content-Type: application/ld+json' and 'Access-Control-Allow-Origin: *' headers but lacks the 'X-Content-Type-Options: nosniff' header, which is present in other response paths. This flaw allows unauthenticated attackers to manipulate JSON-LD responses, potentially impacting clients that consume this structured data. The vulnerability was confirmed on version 2.0.4 and fixed in version 2.0.5 by adding proper JSON escaping and restoring missing security headers.

The vulnerability allows unauthenticated attackers to inject arbitrary content into JSON-LD responses, which are served with permissive CORS headers. This can lead to malformed or attacker-controlled JSON data being consumed by any origin. Although no direct script execution or browser-based exploitation has been demonstrated, the injection represents a CWE-116 output encoding flaw and a missing defense-in-depth security header (X-Content-Type-Options: nosniff) on this response path. This could potentially be exploited by structured-data consumers or in combination with other vulnerabilities.

A patch is available in PrivateBin version 2.0.5 that properly escapes injected content in JSON-LD responses and restores the missing X-Content-Type-Options: nosniff header on this response path. Users should upgrade to version 2.0.5 or later to remediate this issue. Until patched, avoid exposing PrivateBin instances to untrusted clients that might craft raw HTTP requests with unescaped characters in the request URI.