CVE-2026-94108

MediumCVSS 6.5

Published: 20/09/2026(UTC)Updated: 22/09/2026(UTC)Translated: 20/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.43%

37th percentile - higher than 37% of all known CVEs

Summary

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.

Risk Assessment

The risk includes disclosure of sensitive files, SSRF attacks on internal resources, and potential service disruptions.

Recommendation

It is recommended to upgrade getID3 to a version later than 1.9.26 and to ensure the PHP environment is version 8.0 or later, where external entity loading is disabled by default.

Other vulnerabilities in getID3

CVE-2026-94106High
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS