CVE-2026-94108 getID3 through 1.9.26 XML External Entity Injection via XML2array
Attackers can exploit XML external entity injection in getID3 to disclose local files or cause denial of service via malicious media metadata.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-94108?
CVE-2026-94108 is a high-severity vulnerability in james-heinrich getid3, published on 20 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
Weakness: CWE-611
Which versions are affected by CVE-2026-94108?
How do I fix CVE-2026-94108?
Apply the vendor's patch.
Is CVE-2026-94108 being exploited?
There is no known exploitation of CVE-2026-94108 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-94108, GHSA-3hf9-j62w-m548, GHSA-gmhw-pxmg-j22w, UBUNTU-CVE-2026-94108.