p PatchFirst

CVE-2026-94108

CVE-2026-94108 · getID3 through 1.9.26 XML External Entity Injection via XML2array

This page contains facts from public vulnerability sources. Check the original advisory before updating.

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.

CVSS 8.3 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • getid3

    Versions
    • ≥ 0, ≤ 1.9.26: Affected (semver)

    No fix published

  • php-getid3 Debian:12

    Versions
    • 1.9.22+dfsg-1
    • 1.9.23+dfsg-1
    • 1.9.24+dfsg-1
    • 1.9.25+dfsg-1
    • 1.9.26+dfsg-1
    • 1.9.27+dfsg-1
    • 2.0.0~beta1+dfsg-1
    • 2.0.0~beta2-1
    • 2.0.0~beta3-1
    • 2.0.0~beta4+dfsg-1
    • 2.0.0~beta5+dfsg-1
    • 2.0.0~beta6+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-getid3 Debian:13

    Versions
    • 1.9.23+dfsg-1
    • 1.9.24+dfsg-1
    • 1.9.25+dfsg-1
    • 1.9.26+dfsg-1
    • 1.9.27+dfsg-1
    • 2.0.0~beta1+dfsg-1
    • 2.0.0~beta2-1
    • 2.0.0~beta3-1
    • 2.0.0~beta4+dfsg-1
    • 2.0.0~beta5+dfsg-1
    • 2.0.0~beta6+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-getid3 Debian:14

    Versions
    • 1.9.23+dfsg-1
    • 1.9.24+dfsg-1
    • 1.9.25+dfsg-1
    • 1.9.26+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 1.9.27+dfsg-1

    Update to 1.9.27+dfsg-1

  • php-getid3 Ubuntu:16.04:LTS

    Versions
    • 1.9.9+dfsg-2
    • 1.9.10+dfsg-1
    • 1.9.11+dfsg-1
    • 1.9.11+dfsg-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-getid3 Ubuntu:18.04:LTS

    Versions
    • 1.9.14+dfsg-1
    • 1.9.15+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-getid3 Ubuntu:20.04:LTS

    Versions
    • 1.9.17+dfsg-1
    • 1.9.18+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-getid3 Ubuntu:22.04:LTS

    Versions
    • 1.9.20+dfsg-1
    • 1.9.21+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-getid3 Ubuntu:24.04:LTS

    Versions
    • 1.9.22+dfsg-1
    • 1.9.23+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-getid3 Ubuntu:26.10

    Versions
    • 1.9.24+dfsg-1
    • 1.9.25+dfsg-1
    • 1.9.27+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • php-getid3 Ubuntu:26.04:LTS

    Versions
    • 1.9.23+dfsg-1
    • 1.9.24+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →