Skip to content
OpenAdvisories

Package · Debian

php-getid3

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 6.5
    CVE-2026-94108

    getID3 through 1.9.26 XML External Entity Injection via XML2array

    getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, …

    james-heinrich getid3 php-getid3 php-getid3 Debian Ubuntu
  • High 8.8
    CVE-2026-94106

    getID3 before 1.9.26 OS Command Injection via Unescaped Filenames

    getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the …

    james-heinrich getid3 php-getid3 php-getid3 Debian Ubuntu
  • Medium 6.1
    CVE-2021-40926

    Cross-site scripting in demos/demo.mysqli.php in getID3

    Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter.

    php-getid3 php-getid3 james-heinrich/getid3 Debian Ubuntu Packagist
  • High —
    CVE-2014-2053

    getID3 is vulnerable to XML External Entity (XXE)

    getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

    wordpress php-getid3 james-heinrich/getid3 Debian Packagist