CVE-2026-94108 james-heinrich CVE debrief

Who should care

Defenders responsible for PHP environments using getID3 should assess exposure and prioritize verification and potential upgrades. Roles include PHP developers, system administrators, and security teams managing PHP-based systems.

Why it matters

CVE-2026-94108 is a high-severity vulnerability in the widely-used getID3 library. Defenders should prioritize verifying exposure in PHP environments using getID3 version 1.9.26 or earlier and assess the feasibility of upgrading to a secure version. The vulnerability allows for potential local file disclosure, server-side request forgery, and denial of service through entity expansion. Verification of PHP and getID3 versions, as well as implementation of compensating controls, are crucial defensive measures.

• Potential local file disclosure through crafted XML metadata
• Possible server-side request forgery via entity expansion
• Denial of service through entity expansion
• Verification of PHP and getID3 versions for exposure

Technical summary

The getID3 library through version 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function. This function fails to properly disable entity loading in PHP versions before 8.0, allowing attackers to craft malicious XML metadata in media files for potential local file disclosure, server-side request forgery, or denial of service through entity expansion. Defenders should prioritize verifying exposure in PHP environments using getID3 version 1.9.26 or earlier and assessing the feasibility of upgrading to a secure version.

Defensive priority

Defenders should prioritize verifying exposure in PHP environments using getID3 version 1.9.26 or earlier and assessing the feasibility of upgrading to a secure version.

Recommended defensive actions

• Verify getID3 version in use and assess exposure
• Evaluate PHP version and upgrade feasibility
• Monitor for potential denial of service or data disclosure incidents
• Consider implementing compensating controls for entity expansion
• Review vendor patch guidance for getID3
• Perform exposure review for PHP environments using getID3
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the information provided. Defenders should verify getID3 version in use, assess exposure, evaluate PHP version and upgrade feasibility, and monitor for potential denial of service or data disclosure incidents. Compensating controls for entity expansion should be considered.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.