CVE-2026-94106

HIGH 8.8

getID3 before 1.9.26 OS Command Injection via Unescaped Filenames

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.

CWE	CWE-78
Vendor	james-heinrich
Product	getid3
Published	Sep 20, 2026

Stay Ahead of the Next One

Get instant alerts for james-heinrich getid3

Be the first to know when new high vulnerabilities affecting james-heinrich getid3 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

james-heinrich / getid3

0 < 1.9.26

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-qf3m-pmjh-h6fx github.com: https://github.com/JamesHeinrich/getID3/issues/503 github.com: https://github.com/JamesHeinrich/getID3/commit/ce598c4f3823441d878c5a7a2a9f2f703a3e10b6 github.com: https://github.com/JamesHeinrich/getID3/commit/2c6f3f96546f05746405872848114754ed7fe9b4 github.com: https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.26 github.com: https://github.com/JamesHeinrich/getID3/blob/fefffe762b02be155dcc32eec57feff8a49bc4b5/getid3/write.vorbiscomment.php#L85-L110 github.com: https://github.com/JamesHeinrich/getID3 vulncheck.com: https://www.vulncheck.com/advisories/getid3-before-1.9.26-os-command-injection-via-unescaped-filenames

Credits

🔍 Ikram-4