CVE-2026-94108
MEDIUMCVSS 6.5Description
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
Timeline
Published:September 20th, 2026 12:17 PM
Last modified:September 22nd, 2026 8:25 PM
CVSS Scoring
CVSS v3: 6.5 (MEDIUM)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://github.com/JamesHeinrich/getID3
- https://github.com/JamesHeinrich/getID3/blob/0bc49beff9c274f2490ce9a4bb76f5ef50881e08/getid3/getid3.lib.php#L742-L755
- https://github.com/JamesHeinrich/getID3/commit/ce50b4b23439f87716653099718fa1c11b3d15c4
- https://github.com/JamesHeinrich/getID3/issues/505
- https://github.com/JamesHeinrich/getID3/pull/506
- https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-3hf9-j62w-m548
- https://www.vulncheck.com/advisories/getid3-through-1.9.26-xml-external-entity-injection-via-xml2array
Source: NIST NVD · Data may lag official sources by up to one minute