CVE-2026-94108
Medium
Description
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
SeverityMedium
CVSS6.5
Exploit probability—
ProductJames-heinrich Getid3
PublishedSep 20, 2026
First seenSep 20, 2026
Weakness typeCWE-611XML external entity (XXE)
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| james-heinrich getid3 | v ≤ 1.9.26 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.