Medium severity · published Sep 20, 2026
CVE-2026-94108
getID3 through 1.9.26 XML External Entity Injection via XML2array
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
getid3 · james-heinrich
through 1.9.26 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-94108
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-94108
github.com
https://github.com/JamesHeinrich/getID3
github.com
https://github.com/JamesHeinrich/getID3/blob/0bc49beff9c274f2490ce9a4bb76f5ef50881e08/getid3/getid3.lib.php#L742-L755
github.com
https://github.com/JamesHeinrich/getID3/commit/ce50b4b23439f87716653099718fa1c11b3d15c4
github.com
https://github.com/JamesHeinrich/getID3/issues/505
github.com
https://github.com/JamesHeinrich/getID3/pull/506
github.com
https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-3hf9-j62w-m548
More from getid3
8.8
CVE-2026-94106
getID3 before 1.9.26 OS Command Injection via Unescaped Filenames