What is CVE-2026-94108?

CVE-2026-94108 is a medium-severity vulnerability in James-Heinrich Getid3, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 6.5/10. Published 2026-09-20.

How severe is CVE-2026-94108?

Medium severity. CVSS v3 base score is 6.5 out of 10.

XXE in James-Heinrich Getid3

CVE-2026-94108

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.

Vulnerability class: XXE (XML External Entity)

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L.

Affected products

James-heinrich Getid3

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (issue-tracking, patch)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-94108?: CVE-2026-94108 is a medium-severity vulnerability in James-Heinrich Getid3, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 6.5/10. Published 2026-09-20.
How severe is CVE-2026-94108?: Medium severity. CVSS v3 base score is 6.5 out of 10.