Refine your search

2 vulnerabilities found for getid3 by james-heinrich

CVE-2026-94108 (GCVE-0-2026-94108)
Vulnerability from cvelistv5
Published
2026-09-20 11:09
Modified
2026-09-21 15:11
Severity ?
8.3 (High) - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
CWE
  • CWE-611 - Improper Restriction of XML External Entity Reference
Summary
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
References
Impacted products
Vendor Product Version
james-heinrich getid3 Version: 0   ≤ 1.9.26
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94108",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:11:28.651064Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:11:37.792Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/james-heinrich/getid3",
          "product": "getid3",
          "repo": "https://github.com/JamesHeinrich/getID3",
          "vendor": "james-heinrich",
          "versions": [
            {
              "lessThanOrEqual": "1.9.26",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.9.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:41.588Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-3hf9-j62w-m548)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-3hf9-j62w-m548"
        },
        {
          "name": "GitHub Issue #505",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/issues/505"
        },
        {
          "name": "GitHub PR #506",
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/pull/506"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/commit/ce50b4b23439f87716653099718fa1c11b3d15c4"
        },
        {
          "name": "XML2array still unguarded at v1.9.26",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/blob/0bc49beff9c274f2490ce9a4bb76f5ef50881e08/getid3/getid3.lib.php#L742-L755"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/JamesHeinrich/getID3"
        },
        {
          "name": "VulnCheck Advisory: getID3 through 1.9.26 XML External Entity Injection via XML2array",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/getid3-through-1.9.26-xml-external-entity-injection-via-xml2array"
        }
      ],
      "title": "getID3 through 1.9.26 XML External Entity Injection via XML2array",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94108",
    "datePublished": "2026-09-20T11:09:41.588Z",
    "dateReserved": "2026-09-20T10:56:44.077Z",
    "dateUpdated": "2026-09-21T15:11:37.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94106 (GCVE-0-2026-94106)
Vulnerability from cvelistv5
Published
2026-09-20 11:09
Modified
2026-09-21 20:46
Severity ?
8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Summary
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
References
Impacted products
Vendor Product Version
james-heinrich getid3 Version: 0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94106",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T16:42:44.502669Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T20:46:46.047Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/james-heinrich/getid3",
          "product": "getid3",
          "repo": "https://github.com/JamesHeinrich/getID3",
          "vendor": "james-heinrich",
          "versions": [
            {
              "lessThan": "1.9.26",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.9.26",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.9.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:40.215Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-qf3m-pmjh-h6fx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-qf3m-pmjh-h6fx"
        },
        {
          "name": "GitHub Issue #503",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/issues/503"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/commit/ce598c4f3823441d878c5a7a2a9f2f703a3e10b6"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/commit/2c6f3f96546f05746405872848114754ed7fe9b4"
        },
        {
          "name": "getid3 v1.9.26 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.26"
        },
        {
          "name": "unescaped shell_exec arguments at v1.9.25",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/blob/fefffe762b02be155dcc32eec57feff8a49bc4b5/getid3/write.vorbiscomment.php#L85-L110"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/JamesHeinrich/getID3"
        },
        {
          "name": "VulnCheck Advisory: getID3 before 1.9.26 OS Command Injection via Unescaped Filenames",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/getid3-before-1.9.26-os-command-injection-via-unescaped-filenames"
        }
      ],
      "title": "getID3 before 1.9.26 OS Command Injection via Unescaped Filenames",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94106",
    "datePublished": "2026-09-20T11:09:40.215Z",
    "dateReserved": "2026-09-20T10:56:43.390Z",
    "dateUpdated": "2026-09-21T20:46:46.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}