CVE-2026-94108: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-94108 is an XML External Entity (XXE) injection vulnerability in the getID3 PHP library, affecting all versions through 1.9.26. The flaw resides in the XML2array() helper function in getid3/getid3.lib.php, where the use of PHP's @ error suppression operator silently masks failures of libxml_disable_entity_loader(true) on PHP versions before 8.0, leaving external entity loading enabled. Discovered and reported by researcher Ikram-4, the vulnerability was disclosed and patched on September 10, 2026, with the CVE published on September 20, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 8.3 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-611 (Improper Restriction of XML External Entity Reference). In getid3.lib.php around line 749, the XML2array() function calls $loader = @libxml_disable_entity_loader(true); — the @ operator silently suppresses any error, so if the call fails on PHP < 8.0 (where external entity loading is enabled by default), simplexml_load_string() proceeds to parse attacker-controlled XML with external entities active. Additionally, GETID3_LIBXML_OPTIONS was defined as LIBXML_NONET | LIBXML_NOWARNING without LIBXML_NOENT, providing no parser-level defense against entity substitution. An attacker can embed a malicious XML external entity declaration in media file metadata (e.g., iXML chunks in WAV files) and supply that file to any application using getID3 for metadata extraction (GitHub Issue #505, GitHub PR #506, Vulnerable Code).

Successful exploitation on PHP < 8.0 deployments allows an unauthenticated attacker to read arbitrary local files (e.g., /etc/passwd, wp-config.php), perform server-side request forgery (SSRF) to probe internal network services, or cause denial of service via XML entity expansion (Billion Laughs attack). The primary impact is high confidentiality loss, with no integrity impact and low availability impact. Applications that accept user-uploaded media files and process them with getID3 are at greatest risk, as the attack surface is any file upload endpoint that triggers metadata parsing (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.0, indicating very low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the target application to be running PHP < 8.0 and to process attacker-supplied media files with getID3, which is a common pattern in CMS platforms and media management tools — notably, ClassicPress bundles a vulnerable version of getID3.

1. Identify target: Locate a web application running PHP < 8.0 that uses getID3 (version ≤ 1.9.26) to process uploaded media files (e.g., WAV, MP3, or other audio/video formats with XML metadata support).
2. Craft malicious media file: Create a WAV or other supported media file and embed a malicious iXML metadata chunk containing an XXE payload, for example:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<BWFXML><STEINBERG>&xxe;</STEINBERG></BWFXML>

3. Upload the file: Submit the crafted media file through the application's file upload functionality (e.g., media library, attachment upload).
4. Trigger metadata parsing: The application calls getID3's XML2array() to extract metadata; on PHP < 8.0 with a silently-failed libxml_disable_entity_loader(), the external entity is resolved.
5. Retrieve exfiltrated data: The contents of the referenced local file (e.g., /etc/passwd) are embedded in the parsed metadata output, which may be returned in an API response, stored in a database, or logged — allowing the attacker to read it.
6. Escalate (optional): Use SSRF variant payloads (e.g., http://169.254.169.254/latest/meta-data/) to probe internal services, or use Billion Laughs payloads to cause DoS (GitHub Issue #505, GitHub Advisory).

• File System: Presence of getID3 version 1.9.26 or earlier (getid3/getid3.lib.php) on a server running PHP < 8.0; uploaded media files with unusually small audio/video content but large XML metadata sections.
• Logs: Web server access logs showing file uploads (POST requests) to media upload endpoints followed by application errors or unexpected XML parsing warnings in PHP error logs; PHP error log entries referencing simplexml_load_string or libxml_disable_entity_loader failures.
• Network: Outbound HTTP/HTTPS requests from the web server process to internal IP ranges (e.g., 169.254.x.x, 10.x.x.x, 192.168.x.x) or to external attacker-controlled hosts, initiated during media file processing — indicative of SSRF exploitation.
• Application Behavior: Metadata fields in application output or database records containing contents of local system files (e.g., /etc/passwd entries, PHP configuration values) rather than expected audio/video metadata.

Upgrade getID3 to version 1.9.27 or later, which includes the patch merged via commit ce50b4b on September 10, 2026. The fix removes @ error suppression from libxml_disable_entity_loader() calls, adds an explicit failure check that returns false if entity loading cannot be disabled, and adds LIBXML_NOENT to GETID3_LIBXML_OPTIONS as defense-in-depth. If immediate patching is not possible, upgrading the server's PHP version to 8.0 or later eliminates the vulnerability, as PHP 8.0+ disables external entity loading by default. As an additional workaround, restrict file upload functionality to trusted users and validate/sanitize XML metadata in media files before processing (GitHub PR #506, GitHub Commit).

The vulnerability was reported by researcher Ikram-4 via GitHub issue #505 and promptly addressed by maintainer JamesHeinrich with a merged pull request on the same day (September 10, 2026). The advisory notes that ClassicPress bundles a vulnerable version of getID3, which may broaden the affected user base. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation (GitHub Issue #505, GitHub Advisory).