Description

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-20T12:17:06.427Z",
  "pubdate": "2026-09-20T12:17:06.427Z",
  "executiveSummary": "The getID3 library, specifically versions through 1.9.26, is susceptible to an XML External Entity (XXE) injection vulnerability. This flaw originates within the XML2array helper function, which fails to securely configure the underlying XML parser to disable external entity loading when executing on PHP environments prior to version 8.0.\nThe vulnerability allows unauthenticated remote attackers to manipulate media file metadata containing malicious XML structures. Successful exploitation enables the disclosure of sensitive local server files, the execution of Server-Side Request Forgery (SSRF) attacks against internal infrastructure, and the initiation of Denial of Service (DoS) conditions through recursive entity expansion (Billion Laughs attack).\nGiven that getID3 is frequently utilized in file-processing pipelines for media uploads, the risk is significant for applications that process user-supplied media without robust sanitization. The impact ranges from information disclosure to potential remote resource consumption. Upgrading the runtime environment to PHP 8.0 or later is a primary factor in mitigating this vulnerability, as subsequent versions of PHP changed the default behavior regarding internal entity expansion.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper configuration of the XML parser within the XML2array helper function of the getID3 library. In PHP versions prior to 8.0, the libxml library does not disable external entity loading by default. Because the XML2array function does not explicitly invoke libxml_disable_entity_loader(true) prior to parsing, the parser processes external entities defined within the Document Type Definition (DTD) of an XML document.\nThe attack flow begins when an attacker embeds a malicious XML payload within the metadata headers of a media file (such as an ID3 tag or similar container supported by getID3). When the application uses getID3 to inspect or extract metadata from the uploaded file, the library invokes the vulnerable XML2array function to parse the embedded XML content.\nUpon encountering the malicious XML, the parser interprets the DTD and follows instructions to fetch external entities. An attacker can leverage this behavior for several outcomes: First, File Disclosure: By defining an external entity that points to a local file path (e.g., file:///etc/passwd), the parser includes the contents of the target file into the resulting array, which may then be reflected in the application's response or error logs. Second, Server-Side Request Forgery: By defining an external entity pointing to an internal network URI, the server is forced to initiate an HTTP or FTP request to internal resources, bypassing perimeter firewalls. Third, Denial of Service: By defining deeply nested entities (a classic XML bomb), the attacker can force the parser to consume excessive memory and CPU resources, leading to service exhaustion.\nThis vulnerability is restricted to environments running PHP versions earlier than 8.0, as PHP 8.0 deprecated and effectively removed the need for explicit libxml_disable_entity_loader calls due to changes in libxml2 defaults. The vulnerability does not require authentication, as the attack is triggered automatically when the library processes a maliciously crafted media file provided to the application."
}