THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-xrjc-c68j-hp7w (low) — PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI

[GHSA] GHSA-xrjc-c68j-hp7w (low) — PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI

medgithub_advisoriesPublished 2026-08-28

GHSA-xrjc-c68j-hp7w Severity: low CVE: CVE-2026-55891

PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI

## Vulnerability Details

A reflected JSON injection allows an attacker to return arbitrary data in the JSON endpoints (like ` /?jsonld=` and `/?pasteid`).

### Root Cause

`Request::getRequestUri()` sanitizes `$_SERVER['REQUEST_URI']` with `FILTER_SANITIZE

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://github.com/advisories/GHSA-xrjc-c68j-hp7w