Answer in brief
CVE-2026-55891 records a Low severity (CVSS 0.0) vulnerability in PrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URI. The current sources do not mark it as known exploited. The current feed maps privatebin/privatebin (composer), PrivateBin/PrivateBin (generic), privatebin/privatebin (packagist). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 0.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps privatebin/privatebin (composer), PrivateBin/PrivateBin (generic), privatebin/privatebin (packagist). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| privatebin/privatebincomposer | <=2.0.4 | 2.0.5 |
| PrivateBin/PrivateBingeneric | < 2.0.5 | Not reported |
| privatebin/privatebinpackagist | >=0 <2.0.5 | 2.0.5 |
Published upstream
Aug 28, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 28, 2026
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, Request::getRequestUri() in lib/Request.php passes $_SERVER['REQUEST_URI'] through FILTER_SANITIZE_URL, which does not remove quotation marks, angle brackets, or apostrophes, and Controller::_init() stores the attacker-controlled value in Controller::$_urlBase. Controller::_jsonld() in lib/Controller.php then uses str_replace() to insert that value without JSON escaping into js/types.jsonld, js/paste.jsonld, and the other JSON-LD templates used by /?jsonld= and /?pasteid. A raw quotation mark delivered by an HTTP client, proxy, or structured-data crawler that does not normalize the request target can break out of the JSON string and inject arbitrary key-value data into a CORS-open application/ld+json response. The jsonld branch in Controller::__construct() returns before _setCacheHeaders(), so the response also lacks X-Content-Type-Options: nosniff, Content Security Policy, X-Frame-Options, and Referrer-Policy. Direct script execution was not demonstrated, but manipulated responses can affect structured-data consumers or combine with less strict clients. This issue is fixed in version 2.0.5.
Quoted source text, attributed separately from HOL analysis.