getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Getid3 Getid3
cpe:2.3:a:getid3:getid3:*:*:*:*:*:*:*:*
|
— |
<= 1.9.26
|
References 7
https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-3hf9-j62w-m548
GitHub Security Advisory (GHSA-3hf9-j62w-m548)
https://github.com/JamesHeinrich/getID3/issues/505
GitHub Issue #505
https://github.com/JamesHeinrich/getID3/pull/506
GitHub PR #506
https://github.com/JamesHeinrich/getID3/commit/ce50b4b23439f87716653099718fa1c1…
NVD
https://github.com/JamesHeinrich/getID3/blob/0bc49beff9c274f2490ce9a4bb76f5ef50…
XML2array still unguarded at v1.9.26
https://github.com/JamesHeinrich/getID3
NVD
https://www.vulncheck.com/advisories/getid3-through-1.9.26-xml-external-entity-…
VulnCheck Advisory: getID3 through 1.9.26 XML External Entity Injection via XML2array