Search
Find a vulnerability
Search criteria
4 vulnerabilities by james-heinrich
CVE-2026-94108 (GCVE-0-2026-94108)
Vulnerability from nvd – Published: 2026-09-20 11:09 – Updated: 2026-09-21 15:11
VLAI
EPSS
VEX
Title
getID3 through 1.9.26 XML External Entity Injection via XML2array
Summary
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 15:11 UTC
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/JamesHeinrich/getID3/security/… | vendor-advisory |
| https://github.com/JamesHeinrich/getID3/issues/505 | issue-tracking |
| https://github.com/JamesHeinrich/getID3/pull/506 | patchissue-tracking |
| https://github.com/JamesHeinrich/getID3/commit/ce… | patch |
| https://github.com/JamesHeinrich/getID3/blob/0bc4… | technical-description |
| https://github.com/JamesHeinrich/getID3 | product |
| https://www.vulncheck.com/advisories/getid3-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| james-heinrich | getid3 |
Affected:
0 , ≤ 1.9.26
(semver)
cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:* |
Date Public
2026-09-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94108",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:11:28.651064Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:11:37.792Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/james-heinrich/getid3",
"product": "getid3",
"repo": "https://github.com/JamesHeinrich/getID3",
"vendor": "james-heinrich",
"versions": [
{
"lessThanOrEqual": "1.9.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.9.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ikram-4"
}
],
"datePublic": "2026-09-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T11:09:41.588Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-3hf9-j62w-m548)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-3hf9-j62w-m548"
},
{
"name": "GitHub Issue #505",
"tags": [
"issue-tracking"
],
"url": "https://github.com/JamesHeinrich/getID3/issues/505"
},
{
"name": "GitHub PR #506",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/JamesHeinrich/getID3/pull/506"
},
{
"tags": [
"patch"
],
"url": "https://github.com/JamesHeinrich/getID3/commit/ce50b4b23439f87716653099718fa1c11b3d15c4"
},
{
"name": "XML2array still unguarded at v1.9.26",
"tags": [
"technical-description"
],
"url": "https://github.com/JamesHeinrich/getID3/blob/0bc49beff9c274f2490ce9a4bb76f5ef50881e08/getid3/getid3.lib.php#L742-L755"
},
{
"tags": [
"product"
],
"url": "https://github.com/JamesHeinrich/getID3"
},
{
"name": "VulnCheck Advisory: getID3 through 1.9.26 XML External Entity Injection via XML2array",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/getid3-through-1.9.26-xml-external-entity-injection-via-xml2array"
}
],
"title": "getID3 through 1.9.26 XML External Entity Injection via XML2array",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-94108",
"datePublished": "2026-09-20T11:09:41.588Z",
"dateReserved": "2026-09-20T10:56:44.077Z",
"dateUpdated": "2026-09-21T15:11:37.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94106 (GCVE-0-2026-94106)
Vulnerability from nvd – Published: 2026-09-20 11:09 – Updated: 2026-09-21 20:46
VLAI
EPSS
VEX
Title
getID3 before 1.9.26 OS Command Injection via Unescaped Filenames
Summary
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 16:42 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/JamesHeinrich/getID3/security/… | vendor-advisory |
| https://github.com/JamesHeinrich/getID3/issues/503 | issue-tracking |
| https://github.com/JamesHeinrich/getID3/commit/ce… | patch |
| https://github.com/JamesHeinrich/getID3/commit/2c… | patch |
| https://github.com/JamesHeinrich/getID3/releases/… | release-notes |
| https://github.com/JamesHeinrich/getID3/blob/feff… | technical-description |
| https://github.com/JamesHeinrich/getID3 | product |
| https://www.vulncheck.com/advisories/getid3-befor… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| james-heinrich | getid3 |
Affected:
0 , < 1.9.26
(semver)
Unaffected: 1.9.26 (semver) cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:* |
Date Public
2026-09-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94106",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:42:44.502669Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:46:46.047Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/james-heinrich/getid3",
"product": "getid3",
"repo": "https://github.com/JamesHeinrich/getID3",
"vendor": "james-heinrich",
"versions": [
{
"lessThan": "1.9.26",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.9.26",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.9.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ikram-4"
}
],
"datePublic": "2026-09-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T11:09:40.215Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-qf3m-pmjh-h6fx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-qf3m-pmjh-h6fx"
},
{
"name": "GitHub Issue #503",
"tags": [
"issue-tracking"
],
"url": "https://github.com/JamesHeinrich/getID3/issues/503"
},
{
"tags": [
"patch"
],
"url": "https://github.com/JamesHeinrich/getID3/commit/ce598c4f3823441d878c5a7a2a9f2f703a3e10b6"
},
{
"tags": [
"patch"
],
"url": "https://github.com/JamesHeinrich/getID3/commit/2c6f3f96546f05746405872848114754ed7fe9b4"
},
{
"name": "getid3 v1.9.26 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.26"
},
{
"name": "unescaped shell_exec arguments at v1.9.25",
"tags": [
"technical-description"
],
"url": "https://github.com/JamesHeinrich/getID3/blob/fefffe762b02be155dcc32eec57feff8a49bc4b5/getid3/write.vorbiscomment.php#L85-L110"
},
{
"tags": [
"product"
],
"url": "https://github.com/JamesHeinrich/getID3"
},
{
"name": "VulnCheck Advisory: getID3 before 1.9.26 OS Command Injection via Unescaped Filenames",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/getid3-before-1.9.26-os-command-injection-via-unescaped-filenames"
}
],
"title": "getID3 before 1.9.26 OS Command Injection via Unescaped Filenames",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-94106",
"datePublished": "2026-09-20T11:09:40.215Z",
"dateReserved": "2026-09-20T10:56:43.390Z",
"dateUpdated": "2026-09-21T20:46:46.047Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94108 (GCVE-0-2026-94108)
Vulnerability from cvelistv5 – Published: 2026-09-20 11:09 – Updated: 2026-09-21 15:11
VLAI
EPSS
VEX
Title
getID3 through 1.9.26 XML External Entity Injection via XML2array
Summary
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 15:11 UTC
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/JamesHeinrich/getID3/security/… | vendor-advisory |
| https://github.com/JamesHeinrich/getID3/issues/505 | issue-tracking |
| https://github.com/JamesHeinrich/getID3/pull/506 | patchissue-tracking |
| https://github.com/JamesHeinrich/getID3/commit/ce… | patch |
| https://github.com/JamesHeinrich/getID3/blob/0bc4… | technical-description |
| https://github.com/JamesHeinrich/getID3 | product |
| https://www.vulncheck.com/advisories/getid3-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| james-heinrich | getid3 |
Affected:
0 , ≤ 1.9.26
(semver)
cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:* |
Date Public
2026-09-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94108",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:11:28.651064Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:11:37.792Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/james-heinrich/getid3",
"product": "getid3",
"repo": "https://github.com/JamesHeinrich/getID3",
"vendor": "james-heinrich",
"versions": [
{
"lessThanOrEqual": "1.9.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.9.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ikram-4"
}
],
"datePublic": "2026-09-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T11:09:41.588Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-3hf9-j62w-m548)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-3hf9-j62w-m548"
},
{
"name": "GitHub Issue #505",
"tags": [
"issue-tracking"
],
"url": "https://github.com/JamesHeinrich/getID3/issues/505"
},
{
"name": "GitHub PR #506",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/JamesHeinrich/getID3/pull/506"
},
{
"tags": [
"patch"
],
"url": "https://github.com/JamesHeinrich/getID3/commit/ce50b4b23439f87716653099718fa1c11b3d15c4"
},
{
"name": "XML2array still unguarded at v1.9.26",
"tags": [
"technical-description"
],
"url": "https://github.com/JamesHeinrich/getID3/blob/0bc49beff9c274f2490ce9a4bb76f5ef50881e08/getid3/getid3.lib.php#L742-L755"
},
{
"tags": [
"product"
],
"url": "https://github.com/JamesHeinrich/getID3"
},
{
"name": "VulnCheck Advisory: getID3 through 1.9.26 XML External Entity Injection via XML2array",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/getid3-through-1.9.26-xml-external-entity-injection-via-xml2array"
}
],
"title": "getID3 through 1.9.26 XML External Entity Injection via XML2array",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-94108",
"datePublished": "2026-09-20T11:09:41.588Z",
"dateReserved": "2026-09-20T10:56:44.077Z",
"dateUpdated": "2026-09-21T15:11:37.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94106 (GCVE-0-2026-94106)
Vulnerability from cvelistv5 – Published: 2026-09-20 11:09 – Updated: 2026-09-21 20:46
VLAI
EPSS
VEX
Title
getID3 before 1.9.26 OS Command Injection via Unescaped Filenames
Summary
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 16:42 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/JamesHeinrich/getID3/security/… | vendor-advisory |
| https://github.com/JamesHeinrich/getID3/issues/503 | issue-tracking |
| https://github.com/JamesHeinrich/getID3/commit/ce… | patch |
| https://github.com/JamesHeinrich/getID3/commit/2c… | patch |
| https://github.com/JamesHeinrich/getID3/releases/… | release-notes |
| https://github.com/JamesHeinrich/getID3/blob/feff… | technical-description |
| https://github.com/JamesHeinrich/getID3 | product |
| https://www.vulncheck.com/advisories/getid3-befor… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| james-heinrich | getid3 |
Affected:
0 , < 1.9.26
(semver)
Unaffected: 1.9.26 (semver) cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:* |
Date Public
2026-09-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94106",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:42:44.502669Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:46:46.047Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/james-heinrich/getid3",
"product": "getid3",
"repo": "https://github.com/JamesHeinrich/getID3",
"vendor": "james-heinrich",
"versions": [
{
"lessThan": "1.9.26",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.9.26",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.9.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ikram-4"
}
],
"datePublic": "2026-09-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T11:09:40.215Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-qf3m-pmjh-h6fx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-qf3m-pmjh-h6fx"
},
{
"name": "GitHub Issue #503",
"tags": [
"issue-tracking"
],
"url": "https://github.com/JamesHeinrich/getID3/issues/503"
},
{
"tags": [
"patch"
],
"url": "https://github.com/JamesHeinrich/getID3/commit/ce598c4f3823441d878c5a7a2a9f2f703a3e10b6"
},
{
"tags": [
"patch"
],
"url": "https://github.com/JamesHeinrich/getID3/commit/2c6f3f96546f05746405872848114754ed7fe9b4"
},
{
"name": "getid3 v1.9.26 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.26"
},
{
"name": "unescaped shell_exec arguments at v1.9.25",
"tags": [
"technical-description"
],
"url": "https://github.com/JamesHeinrich/getID3/blob/fefffe762b02be155dcc32eec57feff8a49bc4b5/getid3/write.vorbiscomment.php#L85-L110"
},
{
"tags": [
"product"
],
"url": "https://github.com/JamesHeinrich/getID3"
},
{
"name": "VulnCheck Advisory: getID3 before 1.9.26 OS Command Injection via Unescaped Filenames",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/getid3-before-1.9.26-os-command-injection-via-unescaped-filenames"
}
],
"title": "getID3 before 1.9.26 OS Command Injection via Unescaped Filenames",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-94106",
"datePublished": "2026-09-20T11:09:40.215Z",
"dateReserved": "2026-09-20T10:56:43.390Z",
"dateUpdated": "2026-09-21T20:46:46.047Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}