CVE-2026-94106: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-94106 is an OS Command Injection vulnerability (CWE-78) in the getID3 PHP library affecting all versions before 1.9.26. The flaw exists in multiple shell-out handlers that fail to escape filenames before passing them to shell_exec(), allowing attackers to inject arbitrary OS commands via crafted filenames containing shell metacharacters. The vulnerability was reported by researcher Ikram-4 on September 5, 2026, and publicly disclosed via GitHub Security Advisory on September 10, 2026, with a patch released in version 1.9.26 on September 6, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Feedly).

The root cause (CWE-78) is the direct concatenation of user-controlled filename variables — $file, $this->filename, $temp, and $info['filenamepath'] — into shell command strings without applying PHP's escapeshellarg() function. Three specific locations are affected: getid3/getid3.php (the getHashdata() function, ~line 1843, Windows code path for vorbiscomment.exe), getid3/write.vorbiscomment.php (WriteVorbisComment(), lines 90 and 105, both Windows and Linux paths), and getid3/module.audio.shorten.php (~line 135, Windows path for shorten.exe). An attacker with the ability to supply a media filename — for example, test.ogg"; id > /tmp/rce_proof; echo " — causes the shell to parse the semicolon separator and execute the injected command with the privileges of the embedding process (e.g., the web server user). Notably, exploitation succeeds even if the target binary (e.g., vorbiscomment) is absent from the system (GitHub Advisory, Commit ce598c4).

Successful exploitation enables Remote Code Execution (RCE) with the privileges of the process embedding getID3 — typically the web server or PHP process user. This results in full compromise of confidentiality, integrity, and availability of the affected system, including the ability to read sensitive files, modify data, install backdoors, or pivot to other internal systems. Applications commonly embedding getID3 include WordPress, ClassicPress, and custom media uploaders, broadening the potential attack surface significantly (GitHub Advisory, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (Feedly). The vulnerability requires low privileges (an authenticated user capable of supplying a filename to a getID3-powered upload or processing function) and has low attack complexity, making it relatively straightforward to exploit once an attacker has the necessary access. The EPSS score is 0.0 at time of publication, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target: Locate a web application using getID3 versions prior to 1.9.26 that accepts media file uploads or processes user-supplied filenames (e.g., WordPress sites with media upload functionality, custom PHP media processors).
2. Craft malicious filename: Prepare a media file (e.g., an OGG file) with a filename containing shell metacharacters, such as: test.ogg"; id > /tmp/rce_proof; echo "
3. Upload or supply the file: Submit the crafted file through the application's file upload interface or any mechanism that passes the filename to getID3's processing functions (e.g., WriteVorbisComment(), getHashdata(), or the shorten module).
4. Trigger shell-out: Cause the application to invoke a getID3 shell-out handler that processes the filename — for example, by triggering Vorbis comment writing or hash computation on the uploaded file.
5. Command executes: The shell parses the injected metacharacters, breaking out of the intended command context and executing the attacker's payload (e.g., id, a reverse shell, or a file write) with the privileges of the web server process. Execution succeeds even if the target helper binary (e.g., vorbiscomment) is not installed on the system (GitHub Advisory).

• File System: Unexpected files in world-writable directories (e.g., /tmp/rce_proof, web shells in upload directories); new cron jobs or scheduled tasks created by the web server user; modified PHP files in the application directory.
• Logs: Web server access logs showing file upload requests with filenames containing shell metacharacters (;, |, &, $, backticks, >, <); PHP error logs referencing shell_exec() failures or unexpected command output in getID3-related stack traces.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., /bin/sh, bash, curl, wget, python, nc) visible via process monitoring tools; unexpected outbound network connections from the web server process.
• Network: Outbound connections from the web server to unknown external IPs, particularly on non-standard ports, following media file upload events.

The primary remediation is to upgrade getID3 to version 1.9.26 or later, which applies escapeshellarg() to all filename arguments passed to shell_exec() across getid3.php, write.vorbiscomment.php, and module.audio.shorten.php (getID3 Release). For Composer-managed projects, run composer update james-heinrich/getid3. As a temporary workaround where immediate patching is not possible, implement strict server-side filename validation and sanitization to reject or strip shell metacharacters (;, |, &, $, backticks, >, <, ", ') before any filename is passed to getID3 processing functions (GitHub Advisory).

Community discussion on Reddit's r/pwnhub highlighted the patch as a high-severity fix, with users noting the broad impact on WordPress and other CMS platforms that embed getID3 for media processing. The Hacker Wire published a dedicated article on the vulnerability. The getID3 maintainer (JamesHeinrich) responded promptly, releasing the patch within one day of the initial private report and crediting researcher Ikram-4 in the security advisory (Reddit, The Hacker Wire).