getID3 CVE-2026-94106

Exploitation requires all of: (1) the host application invoking getID3's shell-out functions - WriteVorbisComment/WriteMetaFLAC (write.vorbiscomment.php / write.metaflac.php) or the shorten Analyze path (module.audio.shorten.php); (2) the corresponding external helper binaries installed and on GETID3_HELPERAPPSDIR/PATH (vorbiscomment, metaflac, or shorten); and (3) attacker ability to control the filename passed to getID3 so it can contain shell metacharacters. This LIMITS realistic exposure: consumers that only read metadata (the common getID3 use, including WordPress core) do not reach these write/shorten paths, and hosts without the helper binaries cannot trigger the shell-out. PR:L per the vendor vector indicates some authenticated/low-privilege access to the embedding application is needed; there is no user-interaction requirement.

The vendor CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:L/UI:N/VC:H/VI:H/VA:H) reflects high technical impact - arbitrary OS command execution as the embedding process user - but the raw score overstates real-world risk because it does not capture the deployment preconditions. Exploitation is confined to getID3's shell-out code paths: the tag-WRITE handlers WriteMetaFLAC/DeleteMetaFLAC (write.metaflac.php), WriteVorbisComment (write.vorbiscomment.php), and the shorten Analyze path (module.audio.shorten.php). All three require external helper binaries (metaflac, vorbiscomment, shorten) to be installed and the host application to actually invoke these write/shorten functions with an attacker-influenced filename - not the common read-only metadata path that consumers like WordPress core use. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept exploit - only the vendor patch diff serves as source evidence. The vendor sets AT:N/AC:L; I dispute this: the helper-binary and code-path dependency is a genuine condition beyond attacker control, mapping to AT:P (4.0) / AC:H (3.1). Net: a legitimately high-impact code-execution flaw, but likely a targeted/config-dependent issue rather than a broadly automatable one - prioritize where an application is known to use getID3's write or shorten functions on untrusted filenames.

An application that embeds getID3 and lets users influence stored filenames (e.g. an upload/media-management feature) calls a tag-writing function (WriteVorbisComment/WriteMetaFLAC) or the shorten analyzer, with the corresponding helper binary installed. An attacker supplies a filename containing shell metacharacters (e.g. ; wget ...; ) which is concatenated unescaped into the shell command, causing injected commands to execute with the web/process user's privileges. No public exploit code is identified, but the vendor patch diff clearly demonstrates the vulnerable concatenation and the escapeshellarg() fix.