Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    4 vulnerabilities by james-heinrich

    CVE-2026-94108 (GCVE-0-2026-94108)

    Vulnerability from nvd – Published: 2026-09-20 11:09 – Updated: 2026-09-20 11:09
    VLAI
    Title
    getID3 through 1.9.26 XML External Entity Injection via XML2array
    Summary
    getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
    Severity
    8.3 (High)
    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
    CWE
    • CWE-611 - Improper Restriction of XML External Entity Reference
    Assigner
    References
    Impacted products
    Vendor Product Version
    james-heinrich getid3 Affected: 0 , ≤ 1.9.26 (semver)
        cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-09-10 00:00
    Credits
    Ikram-4
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/james-heinrich/getid3",
          "product": "getid3",
          "repo": "https://github.com/JamesHeinrich/getID3",
          "vendor": "james-heinrich",
          "versions": [
            {
              "lessThanOrEqual": "1.9.26",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.9.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:41.588Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-3hf9-j62w-m548)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-3hf9-j62w-m548"
        },
        {
          "name": "GitHub Issue #505",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/issues/505"
        },
        {
          "name": "GitHub PR #506",
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/pull/506"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/commit/ce50b4b23439f87716653099718fa1c11b3d15c4"
        },
        {
          "name": "XML2array still unguarded at v1.9.26",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/blob/0bc49beff9c274f2490ce9a4bb76f5ef50881e08/getid3/getid3.lib.php#L742-L755"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/JamesHeinrich/getID3"
        },
        {
          "name": "VulnCheck Advisory: getID3 through 1.9.26 XML External Entity Injection via XML2array",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/getid3-through-1.9.26-xml-external-entity-injection-via-xml2array"
        }
      ],
      "title": "getID3 through 1.9.26 XML External Entity Injection via XML2array",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94108",
    "datePublished": "2026-09-20T11:09:41.588Z",
    "dateReserved": "2026-09-20T10:56:44.077Z",
    "dateUpdated": "2026-09-20T11:09:41.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-94106 (GCVE-0-2026-94106)

    Vulnerability from nvd – Published: 2026-09-20 11:09 – Updated: 2026-09-20 11:09
    VLAI
    Title
    getID3 before 1.9.26 OS Command Injection via Unescaped Filenames
    Summary
    getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    james-heinrich getid3 Affected: 0 , < 1.9.26 (semver)
    Unaffected: 1.9.26 (semver)
        cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-09-05 00:00
    Credits
    Ikram-4
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/james-heinrich/getid3",
          "product": "getid3",
          "repo": "https://github.com/JamesHeinrich/getID3",
          "vendor": "james-heinrich",
          "versions": [
            {
              "lessThan": "1.9.26",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.9.26",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.9.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:40.215Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-qf3m-pmjh-h6fx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-qf3m-pmjh-h6fx"
        },
        {
          "name": "GitHub Issue #503",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/issues/503"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/commit/ce598c4f3823441d878c5a7a2a9f2f703a3e10b6"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/commit/2c6f3f96546f05746405872848114754ed7fe9b4"
        },
        {
          "name": "getid3 v1.9.26 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.26"
        },
        {
          "name": "unescaped shell_exec arguments at v1.9.25",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/blob/fefffe762b02be155dcc32eec57feff8a49bc4b5/getid3/write.vorbiscomment.php#L85-L110"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/JamesHeinrich/getID3"
        },
        {
          "name": "VulnCheck Advisory: getID3 before 1.9.26 OS Command Injection via Unescaped Filenames",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/getid3-before-1.9.26-os-command-injection-via-unescaped-filenames"
        }
      ],
      "title": "getID3 before 1.9.26 OS Command Injection via Unescaped Filenames",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94106",
    "datePublished": "2026-09-20T11:09:40.215Z",
    "dateReserved": "2026-09-20T10:56:43.390Z",
    "dateUpdated": "2026-09-20T11:09:40.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-94108 (GCVE-0-2026-94108)

    Vulnerability from cvelistv5 – Published: 2026-09-20 11:09 – Updated: 2026-09-20 11:09
    VLAI
    Title
    getID3 through 1.9.26 XML External Entity Injection via XML2array
    Summary
    getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
    Severity
    8.3 (High)
    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
    6.5 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
    CWE
    • CWE-611 - Improper Restriction of XML External Entity Reference
    Assigner
    References
    Impacted products
    Vendor Product Version
    james-heinrich getid3 Affected: 0 , ≤ 1.9.26 (semver)
        cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-09-10 00:00
    Credits
    Ikram-4
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/james-heinrich/getid3",
          "product": "getid3",
          "repo": "https://github.com/JamesHeinrich/getID3",
          "vendor": "james-heinrich",
          "versions": [
            {
              "lessThanOrEqual": "1.9.26",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.9.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:41.588Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-3hf9-j62w-m548)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-3hf9-j62w-m548"
        },
        {
          "name": "GitHub Issue #505",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/issues/505"
        },
        {
          "name": "GitHub PR #506",
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/pull/506"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/commit/ce50b4b23439f87716653099718fa1c11b3d15c4"
        },
        {
          "name": "XML2array still unguarded at v1.9.26",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/blob/0bc49beff9c274f2490ce9a4bb76f5ef50881e08/getid3/getid3.lib.php#L742-L755"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/JamesHeinrich/getID3"
        },
        {
          "name": "VulnCheck Advisory: getID3 through 1.9.26 XML External Entity Injection via XML2array",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/getid3-through-1.9.26-xml-external-entity-injection-via-xml2array"
        }
      ],
      "title": "getID3 through 1.9.26 XML External Entity Injection via XML2array",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94108",
    "datePublished": "2026-09-20T11:09:41.588Z",
    "dateReserved": "2026-09-20T10:56:44.077Z",
    "dateUpdated": "2026-09-20T11:09:41.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-94106 (GCVE-0-2026-94106)

    Vulnerability from cvelistv5 – Published: 2026-09-20 11:09 – Updated: 2026-09-20 11:09
    VLAI
    Title
    getID3 before 1.9.26 OS Command Injection via Unescaped Filenames
    Summary
    getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    james-heinrich getid3 Affected: 0 , < 1.9.26 (semver)
    Unaffected: 1.9.26 (semver)
        cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Date Public
    2026-09-05 00:00
    Credits
    Ikram-4
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/james-heinrich/getid3",
          "product": "getid3",
          "repo": "https://github.com/JamesHeinrich/getID3",
          "vendor": "james-heinrich",
          "versions": [
            {
              "lessThan": "1.9.26",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.9.26",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.9.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-09-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-20T11:09:40.215Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-qf3m-pmjh-h6fx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-qf3m-pmjh-h6fx"
        },
        {
          "name": "GitHub Issue #503",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/issues/503"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/commit/ce598c4f3823441d878c5a7a2a9f2f703a3e10b6"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/commit/2c6f3f96546f05746405872848114754ed7fe9b4"
        },
        {
          "name": "getid3 v1.9.26 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.26"
        },
        {
          "name": "unescaped shell_exec arguments at v1.9.25",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/JamesHeinrich/getID3/blob/fefffe762b02be155dcc32eec57feff8a49bc4b5/getid3/write.vorbiscomment.php#L85-L110"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/JamesHeinrich/getID3"
        },
        {
          "name": "VulnCheck Advisory: getID3 before 1.9.26 OS Command Injection via Unescaped Filenames",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/getid3-before-1.9.26-os-command-injection-via-unescaped-filenames"
        }
      ],
      "title": "getID3 before 1.9.26 OS Command Injection via Unescaped Filenames",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-94106",
    "datePublished": "2026-09-20T11:09:40.215Z",
    "dateReserved": "2026-09-20T10:56:43.390Z",
    "dateUpdated": "2026-09-20T11:09:40.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}