High priorityDisclosed

Advisory · CVE-2026-94106

getID3 shell-out handlers execute crafted media filenames as commands

getID3 before 1.9.26 concatenates media filenames into shell commands without escaping, letting attackers inject arbitrary OS commands that run with the PHP process's privileges. Fixed in 1.9.26.

Advisory published September 20, 2026Independent summary
Vendor
James Heinrich
Product
getID3
Identifier / CWE
CVE-2026-94106
CWE-78
Action timing
Immediate
ELI5

Explain it like I’m five

getID3 reads music and video files like a clerk who also runs errands. When a file arrives, the clerk shouts the file's name to a helper on the street. An attacker names the file so it sounds like a name plus an order, and the helper follows the order as if the clerk said it.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted filename

    The attacker names a media file with shell metacharacters, for example test.ogg"; id > /tmp/rce_proof; echo ".

  2. 02Filename reaches handler

    The filename is passed into getID3's shell-out helper handlers for vorbiscomment or shorten without being escaped.

  3. 03Command string built

    The raw filename is concatenated into a command line handed to shell_exec(), so the shell parses the semicolons as new commands.

  4. 04Code runs as the web user

    The injected commands execute with the privileges of the PHP or web server process, achieving remote code execution on the host.

What happened

The getID3 maintainers disclosed CVE-2026-94106, an OS command injection flaw (CWE-78) in getID3 releases before 1.9.26, scored 8.8 (high). In several shell-out helper handlers, filename arguments such as $file, $this->filename, and $temp were concatenated directly into command strings passed to shell_exec() without escapeshellarg(). The affected spots are the vorbiscomment wrapper in getid3/getid3.php and getid3/write.vorbiscomment.php, plus the shorten.exe wrapper in getid3/module.audio.shorten.php.

The published proof of concept is a media file named test.ogg"; id > /tmp/rce_proof; echo ". When WriteVorbisComment() processes it, the shell splits on the semicolon and runs the injected command with the privileges of the PHP or web server user. The advisory notes the injection fires even when the underlying helper binary is not installed. getID3 is a widely reused PHP library for reading and writing media metadata, bundled into projects such as WordPress and ClassicPress and into many bespoke media uploaders, so the blast radius follows every app that processes uploaded audio or video.

The fix ships in getID3 1.9.26, which wraps all filename arguments in escapeshellarg() (commits 2c6f3f9 and ce598c4). The CVE is not listed in the CISA KEV catalog as of this writing.

What to do

  1. Inventory every PHP application that depends on getID3, including WordPress and ClassicPress installs, media uploaders, and tag editors.
  2. Upgrade getID3 to 1.9.26 or later wherever it appears in a vendor bundle or dependency tree.
  3. If the dependency is bundled by a CMS or plugin, track the vendor’s patched release and do not assume the upstream fix reaches you automatically.
  4. Restrict where possible: tighten media upload permissions, validate and normalize uploaded filenames server-side, and limit which roles can write metadata tags.
  5. Review web server and PHP error and access logs for media uploads with suspicious filenames containing quotes, semicolons, or command separators.
  6. If suspicious uploads reached a handler, treat the host as potentially compromised and investigate before closing the ticket.

Management note

This is a textbook “filename is code” bug in plumbing half the PHP media world leans on. The fix is a one-line version bump, but finding every copy is the actual work, because getID3 usually arrives inside someone else’s plugin. Pair the upgrade with a filename-validation habit on upload paths so the next unsanitized helper never gets the chance.