---
id: CVE-2026-94108
title: >-
  getID3 through 1.9.26 contains an XML external entity injection vulnerability
  in the XML2array helper function that fails to properly disable entity loading
  on PHP before 8.0
summary: >-
  getID3 through 1.9.26 contains an XML external entity injection vulnerability
  in the XML2array helper function that fails to properly disable entity loading
  on PHP before 8.0. Attackers can craft malicious XML metadata in media files
  to …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L'
cwe:
  - CWE-611
vendor: james-heinrich
product: getid3
affected:
  - getid3 <= 1.9.26
published: '2026-09-20'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:25:55.870'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94108'
references:
  - url: 'https://github.com/JamesHeinrich/getID3'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/JamesHeinrich/getID3/blob/0bc49beff9c274f2490ce9a4bb76f5ef50881e08/getid3/getid3.lib.php#L742-L755
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/JamesHeinrich/getID3/commit/ce50b4b23439f87716653099718fa1c11b3d15c4
    label: disclosure@vulncheck.com
  - url: 'https://github.com/JamesHeinrich/getID3/issues/505'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/JamesHeinrich/getID3/pull/506'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-3hf9-j62w-m548
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/getid3-through-1.9.26-xml-external-entity-injection-via-xml2array
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00543
epssPercentile: 0.43319
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T15:11:28.651064Z'
ingestedAt: '2026-09-20T11:20:23.392Z'
---

## Overview

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.