CVE-2026-94108: getID3 through 1.9.26 XML External Entity Injection via XML2array
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getID3to a version that resolves this vulnerability.Fixed in 1.9.26 - Upgrade
Upgrade
getID3to a version that resolves this vulnerability.Fixed in 8.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using getID3 through 1.9.26 on PHP versions before 8.0 are exposed when they process media files whose XML metadata can be attacker-controlled.
What does an attacker need to exploit this issue?
An attacker needs to craft a media file containing malicious XML metadata and have the affected application process it with the XML2array helper function. No authentication or user interaction is required according to the provided vector.
Are default configurations affected?
The issue is tied to PHP versions before 8.0 because entity loading is not properly disabled there. The provided data does not identify any additional configuration prerequisite beyond processing malicious XML metadata.
What can be done if patching is not immediately possible?
Avoid processing untrusted media files with the affected getID3 XML2array functionality on PHP versions before 8.0. Restricting attacker-controlled media ingestion reduces exposure to local-file disclosure, server-side request forgery, and entity-expansion denial of service.