Log in Start free

Vulnerability · Published Sep 20, 2026 · Assigned by VulnCheck

CVE-2026-94108getID3 through 1.9.26 XML External Entity Injection via XML2array

Medium 6.5

In plain English

A medium-severity XML external entity in getid3 from james-heinrich. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 54.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12php-getid3no fix listedDEBIAN-CVE-2026-94108
Debian:13php-getid3no fix listedDEBIAN-CVE-2026-94108
Debian:14php-getid31.9.27+dfsg-1DEBIAN-CVE-2026-94108
Ubuntu:22.04:LTSphp-getid3no fix listedUBUNTU-CVE-2026-94108
Ubuntu:24.04:LTSphp-getid3no fix listedUBUNTU-CVE-2026-94108
Ubuntu:26.04:LTSphp-getid3no fix listedUBUNTU-CVE-2026-94108
Ubuntu:26.10php-getid3no fix listedUBUNTU-CVE-2026-94108

Affected products (as reported)

VendorProductVersions
james-heinrich getid3 0 – through 1.9.26

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

References