CVE-2026-94108 in getID3
Summary
by MITRE • 09/20/2026
getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/20/2026
The identified vulnerability resides within the getID3 library, specifically affecting versions up to and including 1.9.26, due to a critical misconfiguration in its XML parsing capabilities. The core technical flaw is located in the XML2array helper function, which processes metadata embedded within media files such as audio or video containers that support ID3 tags with XML-based structures like APEv2 comments containing CDATA sections. In PHP environments prior to version 8.0, the default configuration for libxml allows external entity loading by default unless explicitly disabled via the LIBXML_NOENT flag or similar restrictions. Because getID3 does not enforce these security constraints when invoking the DOMDocument loadXML method, it inadvertently enables the parser to resolve and process externally defined entities during metadata extraction. This architectural oversight transforms a standard media file parsing operation into an attack vector for XML External Entity injection, commonly referred to as XXE.
The operational impact of this vulnerability is severe due to its potential for multiple distinct exploitation paths against systems that rely on getID3 for analyzing uploaded or processed multimedia content. Attackers can craft malicious metadata within supported media files containing specially crafted XML entities that reference local file system resources using protocols such as file://, thereby allowing the disclosure of sensitive server-side information including configuration files, source code, and credentials stored in plaintext. Furthermore, by leveraging internal network addresses through entity definitions, attackers can perform Server-Side Request Forgery attacks to probe or interact with backend services that are not directly exposed to the internet but remain accessible from the application server's network context. Additionally, the vulnerability facilitates denial of service conditions through billion laughs attacks or similar XML entity expansion techniques where a small payload expands exponentially in memory consumption, potentially crashing the PHP process or exhausting system resources and rendering the associated web application unavailable to legitimate users.
From a classification perspective, this flaw aligns with CWE-611, which describes Improper Restriction of XML External Entity Reference, as it involves the processing of untrusted input that contains references to external entities without proper validation or restriction mechanisms in place. In terms of adversary tactics and techniques, this vulnerability maps directly to ATT&CK technique T1572, Protocol Tunneling, where attackers use established protocols like HTTP for covert communication channels by embedding malicious payloads within legitimate-looking data structures such as XML metadata. It also relates to T1046, Network Service Discovery, when used in conjunction with SSRF capabilities to map internal network topologies and identify additional targets for lateral movement or further exploitation.
Mitigation strategies must address both the immediate code-level defect and broader architectural security postures regarding file uploads and parsing operations. The most effective remediation is to upgrade getID3 to version 1.9.27 or later, where this specific issue has been patched by ensuring that XML parsers are configured with strict security flags that disable external entity resolution by default. For organizations unable to immediately update the library, a robust workaround involves implementing input validation and sanitization at the application layer before passing any metadata content to the getID3 parser. This includes stripping or escaping special characters associated with XML entities and restricting allowed character sets in metadata fields. Additionally, deploying Web Application Firewalls that can detect and block known XXE patterns within HTTP request bodies containing media uploads provides an additional layer of defense-in-depth. System administrators should also ensure that PHP configurations globally disable external entity loading where possible by setting the libxml.disable_entity_loader directive to true, although relying solely on this global setting is discouraged as it may break legitimate functionality in other parts of the application stack and does not replace the need for secure coding practices within specific libraries like getID3.