CVE-2021-29447-PoC

CVE-2021-29447-PoC Overview CVE-2021-29447 is an XML External Entity XXE injection vulnerability affecting WordPress versions 5.6–5.7 patched in 5.7.1 when running PHP 8.0+. The vulnerability resides in the getID3 library used for media metadata parsing. WordPress processes WAV file iXML chunks v...

CVE-2021-29447

WordPress XXE Vulnerability : CVE-2021-29447 A user with the ability to upload a malicious WAVE file like an Author can exploit an XML parsing issue in the Media Library in WordPress leading to XXE attacks and that could lead to file system disclosure Vulnerable code XML External Entity XXE...

[SECURITY] Fedora 43 Update: php-getid3-1.9.28-1.fc43

getID3 is a PHP script that extracts useful information such as ID3 tags, bitrate, playtime, etc. from MP3s & other multimedia file formats Ogg, WMA, WMV, ASF, WAV, AVI, AAC, VQF, FLAC, MusePack, Real, QuickTime, Monkey's Audio, MIDI and more. Autoloader: /usr/share/php/getid3/autoload.php...

[SECURITY] Fedora 44 Update: php-getid3-1.9.28-1.fc44

getID3 is a PHP script that extracts useful information such as ID3 tags, bitrate, playtime, etc. from MP3s & other multimedia file formats Ogg, WMA, WMV, ASF, WAV, AVI, AAC, VQF, FLAC, MusePack, Real, QuickTime, Monkey's Audio, MIDI and more. Autoloader: /usr/share/php/getid3/autoload.php...

CVE-2026-94106

A flaw was found in getID3. This vulnerability allows an attacker with low privileges to inject arbitrary operating system OS commands. By crafting malicious filenames containing special shell characters, an attacker can exploit unescaped filenames in shell-out handlers, leading to the execution ...

[SECURITY] Fedora 45 Update: php-getid3-1.9.27-1.fc45

getID3 is a PHP script that extracts useful information such as ID3 tags, bitrate, playtime, etc. from MP3s & other multimedia file formats Ogg, WMA, WMV, ASF, WAV, AVI, AAC, VQF, FLAC, MusePack, Real, QuickTime, Monkey's Audio, MIDI and more. Autoloader: /usr/share/php/getid3/autoload.php...

Fedora 45 : php-getid3 (2026-6ef35023a5)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6ef35023a5 advisory. Version 1.9.27: 2026-09-22 GHSA-c2xw-vp6w-gpph compressed ID3v2 frames max length GHSA-j649-xr34-mmmh remove LIBXMLNOENT embedded picture in WMA files is...

[SECURITY] Fedora 43 Update: php-getid3-1.9.27-1.fc43

getID3 is a PHP script that extracts useful information such as ID3 tags, bitrate, playtime, etc. from MP3s & other multimedia file formats Ogg, WMA, WMV, ASF, WAV, AVI, AAC, VQF, FLAC, MusePack, Real, QuickTime, Monkey's Audio, MIDI and more. Autoloader: /usr/share/php/getid3/autoload.php...

[SECURITY] Fedora 44 Update: php-getid3-1.9.27-1.fc44

getID3 is a PHP script that extracts useful information such as ID3 tags, bitrate, playtime, etc. from MP3s & other multimedia file formats Ogg, WMA, WMV, ASF, WAV, AVI, AAC, VQF, FLAC, MusePack, Real, QuickTime, Monkey's Audio, MIDI and more. Autoloader: /usr/share/php/getid3/autoload.php...

Fedora 44 : php-getid3 (2026-71df118e18)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-71df118e18 advisory. Version 1.9.27: 2026-09-22 GHSA-c2xw-vp6w-gpph compressed ID3v2 frames max length GHSA-j649-xr34-mmmh remove LIBXMLNOENT embedded picture in WMA files is...

Fedora 43 : php-getid3 (2026-b9ef1180ce)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b9ef1180ce advisory. Version 1.9.27: 2026-09-22 GHSA-c2xw-vp6w-gpph compressed ID3v2 frames max length GHSA-j649-xr34-mmmh remove LIBXMLNOENT embedded picture in WMA files is...

Linux Distros Unpatched Vulnerability : CVE-2026-94106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft...

Linux Distros Unpatched Vulnerability : CVE-2026-94108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection via the XML2array function. An attacker can access sensitive local files, initiate server-side requests, or cause resource exhaustion by submitting specially crafted XML metadata. Details XXE Injection ...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the shell-out handlers process. An attacker can execute arbitrary operating system commands by supplying specially crafted filenames containing shell metacharacters. Remediation Upgrade james-heinrich/getid3 to...

DEBIAN-CVE-2026-94106

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding...

DEBIAN-CVE-2026-94108

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...

CVE-2026-94106

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding...

CVE-2026-94108

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...

CVE-2026-94106

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding...