Description

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-20T12:17:06.110Z",
  "pubdate": "2026-09-20T12:17:06.110Z",
  "executiveSummary": "The getID3 library prior to version 1.9.26 is susceptible to an OS command injection vulnerability located within its shell-out handlers. This flaw arises from insufficient sanitization of filenames passed to underlying system commands. An attacker can leverage this by supplying a crafted filename containing malicious shell metacharacters, which the application then executes unintentionally.\nThe impact of this vulnerability is critical, as it allows for arbitrary command execution on the host server. The injected commands run with the same privileges as the process embedding the getID3 library. This can lead to complete system compromise, unauthorized data access, or lateral movement within the network. Exploitation does not require prior authentication, provided an attacker can influence the filename being processed by the library. This poses a significant risk to any application relying on getID3 for processing user-supplied media files.",
  "technicalDetails": "The vulnerability exists within the shell-out handlers of getID3, which are used to interact with external system utilities for media processing. The root cause is the improper handling of user-controllable input, specifically filenames, when constructing command strings for execution via shell interfaces. The library fails to adequately escape or sanitize these filenames, allowing shell metacharacters—such as backticks, semicolons, or pipe operators—to be interpreted by the underlying command shell.\nThe exploitation flow begins when an attacker provides a maliciously crafted filename to an application that utilizes getID3 to inspect or process that file. If the filename includes shell metacharacters, the shell-out handler effectively concatenates these characters into a system command string without appropriate escaping. When the library triggers the external tool, the operating system executes the unintended, injected payload alongside or instead of the legitimate command.\nBecause the shell executes the command string, the attacker gains the ability to execute arbitrary OS commands within the security context of the user or process running the getID3-embedded application. This bypasses typical application-level security controls, as the injection occurs at the operating system interaction layer. The vulnerability affects all getID3 versions prior to 1.9.26.\nPost-exploitation, an attacker may be able to establish a reverse shell, exfiltrate sensitive files, modify system configuration, or install persistence mechanisms, depending on the privileges of the executing process. No authentication is necessary if the application allows public or unauthenticated users to upload or name files that are subsequently processed by getID3. This vulnerability highlights the risks of passing unsanitized input to system-level execution functions, emphasizing the necessity of robust input validation and the use of argument-passing methods that do not invoke a shell."
}