CVE-2026-94108CWE-611xxe

CVE-2026-94108

Medium · published September 20, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
44.8
In the wild
Unconfirmed
What it is

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
CVSS v4.0
8.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00543 · 44.8th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-09-20T16:17Z
References (7)
https://github.com/JamesHeinrich/getID3 · [email protected]https://github.com/JamesHeinrich/getID3/blob/0bc49beff9c274f2490ce9a4bb76f5ef50881e08/getid3/getid3.lib.php#L742-L755 · [email protected]https://github.com/JamesHeinrich/getID3/commit/ce50b4b23439f87716653099718fa1c11b3d15c4 · [email protected]https://github.com/JamesHeinrich/getID3/issues/505 · [email protected]https://github.com/JamesHeinrich/getID3/pull/506 · [email protected]https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-3hf9-j62w-m548 · [email protected]https://www.vulncheck.com/advisories/getid3-through-1.9.26-xml-external-entity-injection-via-xml2array · [email protected]
EPSS history
Timeline
  • 22 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 20 SEP 11:09Z
    getID3 through 1.9.26 XML External Entity Injection via XML2array
    cvelistv5