p PatchFirst

CVE-2026-94106

CVE-2026-94106 · getID3 before 1.9.26 OS Command Injection via Unescaped Filenames

This page contains facts from public vulnerability sources. Check the original advisory before updating.

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.

CVSS 8.7 · High · EPSS 1.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • getid3

    Versions
    • ≥ 0, < 1.9.26: Affected (semver)
    • 1.9.26: Not affected (semver)

    Update to 1.9.26

  • php-getid3 Debian:12

    Versions
    • 1.9.22+dfsg-1
    • 1.9.23+dfsg-1
    • 1.9.24+dfsg-1
    • 1.9.25+dfsg-1
    • 1.9.26+dfsg-1
    • 1.9.27+dfsg-1
    • 2.0.0~beta1+dfsg-1
    • 2.0.0~beta2-1
    • 2.0.0~beta3-1
    • 2.0.0~beta4+dfsg-1
    • 2.0.0~beta5+dfsg-1
    • 2.0.0~beta6+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-getid3 Debian:13

    Versions
    • 1.9.23+dfsg-1
    • 1.9.24+dfsg-1
    • 1.9.25+dfsg-1
    • 1.9.26+dfsg-1
    • 1.9.27+dfsg-1
    • 2.0.0~beta1+dfsg-1
    • 2.0.0~beta2-1
    • 2.0.0~beta3-1
    • 2.0.0~beta4+dfsg-1
    • 2.0.0~beta5+dfsg-1
    • 2.0.0~beta6+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-getid3 Debian:14

    Versions
    • 1.9.23+dfsg-1
    • 1.9.24+dfsg-1
    • 1.9.25+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 1.9.26+dfsg-1

    Update to 1.9.26+dfsg-1

  • php-getid3 Ubuntu:16.04:LTS

    Versions
    • 1.9.9+dfsg-2
    • 1.9.10+dfsg-1
    • 1.9.11+dfsg-1
    • 1.9.11+dfsg-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-getid3 Ubuntu:18.04:LTS

    Versions
    • 1.9.14+dfsg-1
    • 1.9.15+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-getid3 Ubuntu:20.04:LTS

    Versions
    • 1.9.17+dfsg-1
    • 1.9.18+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-getid3 Ubuntu:22.04:LTS

    Versions
    • 1.9.20+dfsg-1
    • 1.9.21+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-getid3 Ubuntu:24.04:LTS

    Versions
    • 1.9.22+dfsg-1
    • 1.9.23+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-getid3 Ubuntu:26.10

    Versions
    • 1.9.24+dfsg-1
    • 1.9.25+dfsg-1
    • 1.9.27+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-getid3 Ubuntu:26.04:LTS

    Versions
    • 1.9.23+dfsg-1
    • 1.9.24+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →