CVE-2026-94108 | BDVDB-2026-377271 Detail
james-heinrichgetid3
Description#
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact low. Attack vector: network.
Weaknesses#
- CWE-611 Improper Restriction of XML External Entity Reference
References#
- https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-3hf9-j62w-m548
- https://github.com/JamesHeinrich/getID3/issues/505
- https://github.com/JamesHeinrich/getID3/pull/506
- https://github.com/JamesHeinrich/getID3/commit/ce50b4b23439f87716653099718fa1c11b3d15c4
- https://github.com/JamesHeinrich/getID3/blob/0bc49beff9c274f2490ce9a4bb76f5ef50881e08/getid3/getid3.lib.php#L742-L755
- https://github.com/JamesHeinrich/getID3
- https://www.vulncheck.com/advisories/getid3-through-1.9.26-xml-external-entity-injection-via-xml2array
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.