CVE-2026-94108: getID3 XXE Vulnerability in XML Processing

CVE-2026-94108 Overview

CVE-2026-94108 is an XML External Entity (XXE) injection vulnerability [CWE-611] in the getID3 PHP library through version 1.9.26. The flaw resides in the XML2array helper function within getid3.lib.php, which fails to properly disable external entity loading on PHP versions before 8.0. Attackers can embed malicious XML metadata inside media files processed by getID3 to disclose local files, perform Server-Side Request Forgery (SSRF), or trigger denial of service through entity expansion. The vulnerability affects any web application that uses getID3 to parse untrusted media uploads.

Critical Impact
Remote unauthenticated attackers can read arbitrary files readable by the PHP process and pivot to internal network resources by uploading crafted media files.

Affected Products

getID3 PHP library versions through 1.9.26
Applications running getID3 on PHP versions earlier than 8.0
Media processing pipelines invoking the XML2array helper in getid3.lib.php

Discovery Timeline

2026-09-20 - CVE-2026-94108 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94108

Vulnerability Analysis

The getID3 library parses metadata contained in media containers, including XML-based structures such as those found in MP4/QuickTime uuid boxes and other audio and video formats. The XML2array helper function in getid3/getid3.lib.php invokes libxml with a set of options controlled by the GETID3_LIBXML_OPTIONS constant. Before the fix, this constant did not include LIBXML_NOENT handling that fully suppressed external entity resolution across all supported PHP versions.

On PHP versions earlier than 8.0, libxml still resolves external entities by default unless explicitly disabled. An attacker who supplies a media file whose XML metadata contains an external entity declaration can force the parser to fetch local files or remote URLs during parsing.

Root Cause

The root cause is insufficient hardening of libxml options passed to XML parsing calls in XML2array. The vulnerability aligns with [CWE-611: Improper Restriction of XML External Entity Reference]. Because getID3 targets a wide range of PHP versions, it cannot rely on the safer libxml defaults introduced in PHP 8.0 and libxml2 2.9.0. Without an explicit safe-parsing directive, entity resolution proceeds and processes attacker-controlled URIs.

Attack Vector

Exploitation requires an attacker to submit a media file to an endpoint that invokes getID3's analysis routines on the uploaded content. The malicious file embeds an XML fragment with a SYSTEM external entity pointing to a local path such as file:///etc/passwd or an internal HTTP endpoint. When getID3 parses the metadata, libxml resolves the entity and the referenced content is included in the returned data structure, echoed in error messages, or exfiltrated via out-of-band DNS or HTTP requests. The same primitive supports SSRF against cloud metadata services and denial of service via nested entity expansion (billion laughs).

php

// Patch applied in getid3/getid3.lib.php - adds LIBXML_NOENT to disable entity substitution
if (!defined('GETID3_LIBXML_OPTIONS') && defined('LIBXML_VERSION')) {
    if (LIBXML_VERSION >= 20621) {
-       define('GETID3_LIBXML_OPTIONS', LIBXML_NONET | LIBXML_NOWARNING | LIBXML_COMPACT);
+       define('GETID3_LIBXML_OPTIONS', LIBXML_NONET | LIBXML_NOENT | LIBXML_NOWARNING | LIBXML_COMPACT);
    } else {
-       define('GETID3_LIBXML_OPTIONS', LIBXML_NONET | LIBXML_NOWARNING);
+       define('GETID3_LIBXML_OPTIONS', LIBXML_NONET | LIBXML_NOENT | LIBXML_NOWARNING);
    }
}
// Source: https://github.com/JamesHeinrich/getID3/commit/ce50b4b23439f87716653099718fa1c11b3d15c4

Detection Methods for CVE-2026-94108

Indicators of Compromise

Outbound HTTP or DNS requests from PHP worker processes to attacker-controlled domains immediately after media upload events.
Access to sensitive local files such as /etc/passwd, /proc/self/environ, or application configuration files during getID3 parsing.
PHP or libxml error logs showing entity resolution failures referencing external URIs or SYSTEM identifiers.
Uploaded media files whose metadata contains <!DOCTYPE or <!ENTITY declarations.

Detection Strategies

Inspect uploaded media in transit or at rest for XML fragments containing <!DOCTYPE, <!ENTITY, or SYSTEM keywords inside metadata boxes.
Correlate media processing jobs with outbound network connections initiated by the PHP-FPM or webserver process.
Alert on file reads by the web application user targeting sensitive paths outside the application document root.

Monitoring Recommendations

Enable libxml warning capture in PHP and forward logs to a central SIEM for review.
Monitor egress traffic from application servers and baseline expected destinations for the media processing tier.
Track invocations of getID3 methods with per-request telemetry that includes source IP, uploaded filename, and downstream network activity.

How to Mitigate CVE-2026-94108

Immediate Actions Required

Update getID3 to the patched revision that includes commit ce50b4b23439f87716653099718fa1c11b3d15c4 from the getID3 GitHub repository.
Upgrade the underlying PHP runtime to version 8.0 or later where libxml disables external entity loading by default.
Restrict outbound network access from web application servers to block SSRF exfiltration paths.

Patch Information

The maintainer merged pull request #506 referenced in issue #505, adding the LIBXML_NOENT flag to GETID3_LIBXML_OPTIONS in getid3/getid3.lib.php. Additional context is available in GitHub Security Advisory GHSA-3hf9-j62w-m548 and the VulnCheck Advisory on getID3.

Workarounds

Pre-define the GETID3_LIBXML_OPTIONS constant in application bootstrap code to include LIBXML_NONET | LIBXML_NOENT | LIBXML_NOWARNING before loading getID3.
Strip or reject XML metadata blocks in uploaded media using a preprocessing step before invoking getID3.
Run media processing in an isolated sandbox with no filesystem access to sensitive paths and no route to internal networks.

bash

# Pin getID3 to a patched revision and enforce safe libxml options
composer require james-heinrich/getid3:">=1.9.27"

# In application bootstrap (before requiring getID3):
php -r "define('GETID3_LIBXML_OPTIONS', LIBXML_NONET | LIBXML_NOENT | LIBXML_NOWARNING | LIBXML_COMPACT);"