CVEvulnerability
CVE-2026-94108
8.3 HIGH
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-09-20
- Last modified
- 2026-09-22
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.3 HIGH — CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
- Weaknesses
- CWE-611
Description
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
Related
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- https://github.com/JamesHeinrich/getID3 github.com
- https://github.com/JamesHeinrich/getID3/blob/0bc49beff9c274f2490ce9a4bb76f5ef50881e08/getid3/getid3.lib.php#L742-L755 github.com
- https://github.com/JamesHeinrich/getID3/commit/ce50b4b23439f87716653099718fa1c11b3d15c4 github.com
- https://github.com/JamesHeinrich/getID3/issues/505 github.com
- https://github.com/JamesHeinrich/getID3/pull/506 github.com
- https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-3hf9-j62w-m548 github.com
- https://www.vulncheck.com/advisories/getid3-through-1.9.26-xml-external-entity-injection-via-xml2array www.vulncheck.com