CVE-2026-94108

MEDIUM 6.5

getID3 through 1.9.26 XML External Entity Injection via XML2array

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.

CWE	CWE-611
Vendor	james-heinrich
Product	getid3
Published	Sep 20, 2026

Stay Ahead of the Next One

Get instant alerts for james-heinrich getid3

Be the first to know when new medium vulnerabilities affecting james-heinrich getid3 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Affected Versions

james-heinrich / getid3

0 ≤ 1.9.26

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-3hf9-j62w-m548 github.com: https://github.com/JamesHeinrich/getID3/issues/505 github.com: https://github.com/JamesHeinrich/getID3/pull/506 github.com: https://github.com/JamesHeinrich/getID3/commit/ce50b4b23439f87716653099718fa1c11b3d15c4 github.com: https://github.com/JamesHeinrich/getID3/blob/0bc49beff9c274f2490ce9a4bb76f5ef50881e08/getid3/getid3.lib.php#L742-L755 github.com: https://github.com/JamesHeinrich/getID3 vulncheck.com: https://www.vulncheck.com/advisories/getid3-through-1.9.26-xml-external-entity-injection-via-xml2array

Credits

🔍 Ikram-4