CVE-2026-94108

Name of the Vulnerable Software and Affected Versions getID3 versions prior to 1.9.27

Description An XML external entity injection issue exists in the XML2array() helper function. The function fails to properly disable entity loading when running on PHP versions before 8.0. This allows attackers to use malicious XML metadata within media files to disclose local files, perform server-side request forgery (SSRF), or cause a denial of service through entity expansion.

Recommendations Update to version 1.9.27 or later. As a temporary mitigation, restrict the processing of media files containing XML metadata using the XML2array() function.