CVE-2026-94108— getID3 through 1.9.26 XML External Entity Injection via XML2array
Quick assessment
Affected
james-heinrich getid3
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
getID3 在 1.9.26 及之前版本中存在一个 XML 外部实体（XXE）注入漏洞，该漏洞位于 XML2array 辅助函数中。此函数在 PHP 8.0 之前的版本中未能正确禁用实体加载。攻击者可通过在媒体文件中构造恶意的 XML 元数据，从而实现本地文件泄露、执行服务器端请求伪造（SSRF），或通过实体扩展导致拒绝服务（DoS）攻击。
Possible ATT&CK Techniques 1 AI
T1566.001 · Spearphishing Attachment
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-94108
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
getID3 through 1.9.26 XML External Entity Injection via XML2array
Source: CVE Program / CVE List V5
Vulnerability Description
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| james-heinrich | getid3 | 0 ~ 1.9.26 | - |
|
II. Public POCs for CVE-2026-94108
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-94108
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-94108 (2)
Vendor Advisories for CVE-2026-94108 (1)
Other References for CVE-2026-94108 (2)
IV. Related Vulnerabilities
Same weakness: CWE-611
-
CVE-2026-76427
Cisco ISE XML External Entity Injection Vulnerability -
CVE-2026-76446
Cisco Identity Services Engine External Entity Injection Vul -
CVE-2026-12666
IBM MQ Java messaging is vulnerable to XML external entity i -
CVE-2026-12667
IBM MQ .NET client is vulnerable to XML external entity inje -
CVE-2026-12752
Multiple security vulnerabilities addressed with IBM Busines
V. Comments for CVE-2026-94108
No comments yet