CVE-2026-94106

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.

An attacker could execute arbitrary system commands with the privileges of the application using getID3, potentially leading to server compromise or data exposure. It requires delivering a file with a malicious filename for processing.

Update getID3 to version 1.9.26 or later and avoid passing untrusted filenames to shell-out handlers.