What’s Vulnerable › Vulnerabilities

CVE-2026-94108: getID3 through 1.9.26 XML External Entity Injection via XML2array

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-20 · updated 2026-09-22
• Weakness: CWE-611

Description

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.

Affected products

• james-heinrich getid3: through 1.9.26

References

• https://github.com/JamesHeinrich/getID3
• https://github.com/JamesHeinrich/getID3/blob/0bc49beff9c274f2490ce9a4bb76f5ef50881e08/getid3/getid3.lib.php#L742-L755
• https://github.com/JamesHeinrich/getID3/commit/ce50b4b23439f87716653099718fa1c11b3d15c4
• https://github.com/JamesHeinrich/getID3/issues/505
• https://github.com/JamesHeinrich/getID3/pull/506
• https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-3hf9-j62w-m548
• https://www.vulncheck.com/advisories/getid3-through-1.9.26-xml-external-entity-injection-via-xml2array

Get alerted when CVE-2026-94108 or the next vulnerability affects your stack