Getid3
Monthly
XML external entity injection in getID3 1.9.26 and earlier allows an attacker who can get a crafted media file parsed by the library's XML2array helper to read local files, potentially trigger server-side request forgery, and cause denial of service through entity expansion. The flaw only manifests on PHP versions earlier than 8.0, where libxml does not disable external entity loading by default and getID3's error-suppressed libxml_disable_entity_loader() call can fail silently; on PHP 8.0 and later the vulnerable code path does not trigger at all. No authentication or user interaction is required once those preconditions hold - the only requirement is that the application ingests attacker-influenced media metadata - and no public exploit identified at time of analysis, though the vendor has published a fix. Independent assessment rates the dominant impact as high-confidentiality local file disclosure (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L), with integrity impact absent and availability impact limited.
OS command injection in getID3 versions before 1.9.26 allows an attacker who controls the filename passed to the library's shell-out handlers to execute arbitrary operating-system commands with the privileges of the embedding process. The vulnerable code paths build shell command lines around filenames using simple double quotes instead of escaping them, and they are reached through the shorten audio analyzer (module.audio.shorten.php) and the Vorbis comment / MetaFLAC write helpers (write.vorbiscomment.php, write.metaflac.php). Practical exposure is constrained: the host application must call those write or shorten routines and must have the vorbiscomment, metaflac, or shorten helper binaries installed and on GETID3_HELPERAPPSDIR or PATH, and low-privilege access to the embedding application is required per the vendor vector; the flaw is fixed in 1.9.26, and no public exploit code has been identified at time of analysis.
Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
XML external entity injection in getID3 1.9.26 and earlier allows an attacker who can get a crafted media file parsed by the library's XML2array helper to read local files, potentially trigger server-side request forgery, and cause denial of service through entity expansion. The flaw only manifests on PHP versions earlier than 8.0, where libxml does not disable external entity loading by default and getID3's error-suppressed libxml_disable_entity_loader() call can fail silently; on PHP 8.0 and later the vulnerable code path does not trigger at all. No authentication or user interaction is required once those preconditions hold - the only requirement is that the application ingests attacker-influenced media metadata - and no public exploit identified at time of analysis, though the vendor has published a fix. Independent assessment rates the dominant impact as high-confidentiality local file disclosure (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L), with integrity impact absent and availability impact limited.
OS command injection in getID3 versions before 1.9.26 allows an attacker who controls the filename passed to the library's shell-out handlers to execute arbitrary operating-system commands with the privileges of the embedding process. The vulnerable code paths build shell command lines around filenames using simple double quotes instead of escaping them, and they are reached through the shorten audio analyzer (module.audio.shorten.php) and the Vorbis comment / MetaFLAC write helpers (write.vorbiscomment.php, write.metaflac.php). Practical exposure is constrained: the host application must call those write or shorten routines and must have the vorbiscomment, metaflac, or shorten helper binaries installed and on GETID3_HELPERAPPSDIR or PATH, and low-privilege access to the embedding application is required per the vendor vector; the flaw is fixed in 1.9.26, and no public exploit code has been identified at time of analysis.
Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.