CVE-2026-94106
getID3 before 1.9.26 OS Command Injection via Unescaped Filenames
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
getID3 before 1.9.26 OS Command Injection via Unescaped Filenames
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
- Record
CVE-2026-94106- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2026-83726
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
- Record
EUVD-2026-83726- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7c6f-jc48-6hfq
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that...
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
- Record
GHSA-7c6f-jc48-6hfq- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
- Record
CVE-2026-94106- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
getID3 before 1.9.26 OS Command Injection via Unescaped Filenames
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
- Record
CVE-2026-94106- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-94106
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
- Record
DEBIAN-CVE-2026-94106- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-94106
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
- Record
UBUNTU-CVE-2026-94106- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php-getid3Debian:12 |
All versions, plus listed versions 1.9.22+dfsg-11.9.23+dfsg-11.9.24+dfsg-11.9.25+dfsg-11.9.26+dfsg-1 Show 7 moreShow less1.9.27+dfsg-12.0.0~beta1+dfsg-12.0.0~beta2-12.0.0~beta3-12.0.0~beta4+dfsg-12.0.0~beta5+dfsg-12.0.0~beta6+dfsg-1 |
None known |
php-getid3Debian:13 |
All versions, plus listed versions 1.9.23+dfsg-11.9.24+dfsg-11.9.25+dfsg-11.9.26+dfsg-11.9.27+dfsg-1 Show 6 moreShow less2.0.0~beta1+dfsg-12.0.0~beta2-12.0.0~beta3-12.0.0~beta4+dfsg-12.0.0~beta5+dfsg-12.0.0~beta6+dfsg-1 |
None known |
php-getid3Debian:14 |
before 1.9.26+dfsg-1, plus listed versions 1.9.23+dfsg-11.9.24+dfsg-11.9.25+dfsg-1 |
1.9.26+dfsg-1 |
php-getid3Ubuntu:16.04:LTS |
All versions, plus listed versions 1.9.9+dfsg-21.9.10+dfsg-11.9.11+dfsg-11.9.11+dfsg-1build1 |
None known |
php-getid3Ubuntu:18.04:LTS |
All versions, plus listed versions 1.9.14+dfsg-11.9.15+dfsg-1 |
None known |
php-getid3Ubuntu:20.04:LTS |
All versions, plus listed versions 1.9.17+dfsg-11.9.18+dfsg-1 |
None known |
php-getid3Ubuntu:22.04:LTS |
All versions, plus listed versions 1.9.20+dfsg-11.9.21+dfsg-1 |
None known |
php-getid3Ubuntu:24.04:LTS |
All versions, plus listed versions 1.9.22+dfsg-11.9.23+dfsg-1 |
None known |
php-getid3Ubuntu:26.10 |
All versions, plus listed versions 1.9.24+dfsg-11.9.25+dfsg-11.9.27+dfsg-1 |
None known |
php-getid3Ubuntu:26.04:LTS |
All versions, plus listed versions 1.9.23+dfsg-11.9.24+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-94106 is a high vulnerability (CVSS 8.7) in James-heinrich Getid3, published September 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.66%, the 76th percentile. Fixed in php-getid3 1.9.26+dfsg-1.
References
github.com/JamesHeinrich/getID3/security/advisories/GHSA-qf3m-pmjh-h6fx
Show 8 moreShow less
vulncheck.com/advisories/getid3-before-1.9.26-os-command-injection-via-unescaped-filenames
nvd.nist.gov/vuln/detail/CVE-2026-94106
security-tracker.debian.org/tracker/CVE-2026-94106
ubuntu.com/security/CVE-2026-94106
cve.org/CVERecord?id=CVE-2026-94106