getID3 CVE-2026-94108

Exploitation requires the target application to (1) run on PHP earlier than 8.0, where libxml does not disable external-entity loading by default and getID3's @libxml_disable_entity_loader() could fail silently, and (2) invoke getID3's XML2array helper on attacker-influenced XML metadata inside a media file. The attacker must be able to deliver a crafted media file to be parsed (e.g., via an upload feature). On PHP 8.0 and later the flaw does not trigger at all, which is the dominant limiting factor; additionally AC:H/AT:P reflect that entity-loading behavior and success are runtime/config dependent. No authentication is required (PR:N) once these preconditions hold, and no user interaction is needed beyond the application parsing the file.

The vendor CVSS 4.0 score of 8.3 (High) rests on AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L, and the elevated number is driven mainly by VC:H (local file disclosure). Critically, AC:H and AT:P are correctly assigned: the flaw is gated on a legacy runtime - it only manifests on PHP before 8.0, where libxml did not disable external-entity loading by default and the code's @libxml_disable_entity_loader() call could silently fail. On PHP 8.0+ (the mainstream supported line since 2020) the vulnerability does not trigger, which sharply narrows the real-world exposed population. No EPSS score, no CISA KEV listing, and no public POC accompany this report, so there is no signal of active or imminent exploitation. This is best characterized as a real but conditional bug: the ubiquity of getID3 (bundled in WordPress core and many PHP media apps) raises theoretical reach, but the hard PHP<8.0 precondition plus attacker needing to plant crafted XML metadata inside a parsed media file makes it a moderate, patch-in-normal-cycle priority rather than an emergency. VI:N is appropriate (read/SSRF/DoS, no integrity write); VA:L reflects the entity-expansion DoS path.

An attacker uploads or supplies a media file whose embedded XML metadata (e.g., ID3/ASF/other XML-bearing tags) contains a malicious external entity, to an application that runs on PHP < 8.0 and uses getID3's XML2array helper to parse it. When parsed, the entity resolves to disclose local files (e.g., configuration or credentials), perform SSRF against internal endpoints, or trigger an entity-expansion (billion-laughs) denial of service. No public exploit code is identified at time of analysis, and exploitation is impossible on PHP 8.0 or later.