CVE-2026-94106: getID3 before 1.9.26 OS Command Injection via Unescaped Filenames
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications embedding getID3 before 1.9.26 are exposed when they process attacker-controlled filenames through affected shell-out handlers. Any injected command runs with the privileges of the process using getID3.
What does an attacker need to exploit it?
An attacker needs the ability to cause the application to process a filename containing shell metacharacters. No user interaction is required, but the attacker must have the privileges needed to supply or control the filename.
What should be done if patching cannot happen immediately?
Prevent untrusted users or upstream sources from supplying filenames to the affected getID3 processing path, especially filenames containing shell metacharacters. Run the embedding process with the least privileges possible to limit the impact of command execution.
How can I determine whether an application is affected?
Identify applications that embed getID3 and determine whether they use a version before 1.9.26. Prioritize instances that invoke shell-out handlers while processing filenames obtained from untrusted sources.