CVE-2026-94106
Received Received - Intake

OS Command Injection in getID3 Before 1.9.26

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: VulnCheck

Description
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-94106
EUVD
EUVD-2026-83726

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in getID3 versions before 1.9.26. Attackers can exploit it by uploading files with malicious filenames containing shell metacharacters. When processed, these filenames are passed directly to shell commands without proper escaping, allowing arbitrary command execution with the privileges of the getID3 process.

Detection Guidance

Check getID3 version with grep -r 'getID3' /path/to/your/project | grep -i version. If version is below 1.9.26, the system is vulnerable. Inspect files like getid3.php, write.vorbiscomment.php, and module.audio.shorten.php for unescaped shell_exec calls.

Impact Analysis

If you use getID3 in your application, an attacker could execute arbitrary commands on your server by uploading a file with a specially crafted filename. This could lead to full system compromise, data theft, or further network infiltration, depending on the server's permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Upgrade getID3 to version 1.9.26 or later. Review and sanitize all filenames processed by getID3. Apply escapeshellarg() to file paths in shell commands. Monitor for unusual command execution in system logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94106. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart