Catalogo CVE
CVE-2026-94106
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell met
- Gravità
- High · CVSS 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 1.66% · Oct 22, 2026
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | php-getid3 | sid | 1.9.27+dfsg-1 | fixed |
| Debian | php-getid3 | forky | 1.9.27+dfsg-1 | fixed |
| Debian | php-getid3 | trixie | 1.9.23+dfsg-1 | vulnerable |
| Debian | php-getid3 | bookworm | 1.9.22+dfsg-1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | php-getid3 | source | sid | 1.9.26+dfsg-1 | not yet assigned | Not reported | [1148666] |
| Debian | php-getid3 | source | forky | 1.9.26+dfsg-1 | not yet assigned | Not reported | [1148666] |
| Debian | php-getid3 | source | trixie | (unfixed) | not yet assigned | Not reported | [1148666] |
| Debian | php-getid3 | source | bookworm | (unfixed) | not yet assigned | Not reported | [1148666] |
Notes
[trixie] php-getid3: Minor issue [bookworm] php-getid3: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [php-getid3]Interessata
Dettagli (2)
1.9.22+dfsg-1· all · bookwormInteressata
nvd · php-getid3 · debian · bookworm; nvd · php-getid3 · debian · 12
1.9.22+dfsg-1· all · bookwormInteressata
nvd · php-getid3 · debian · bookworm; nvd · php-getid3 · debian · 12
[Debian 13 (Trixie)]
- [php-getid3]Interessata
Dettagli (2)
1.9.23+dfsg-1· all · trixieInteressata
nvd · php-getid3 · debian · 13
1.9.23+dfsg-1· all · trixieInteressata
nvd · php-getid3 · debian · 13
Osservato: