AIKIDO-2026-518662
james-heinrich/getid3 is vulnerable to XML External Entity (XXE) Injection
65
Medium Risk
This Affects:
james-heinrich/getid3TL;DR
getID3 parses XML metadata such as RIFF/WAV iXML through simplexml_load_string() after calling libxml_disable_entity_loader(true) behind the @ error-suppression operator. On PHP before 8.0 that call can fail silently, leaving external entity resolution enabled for the following parse. A crafted media file whose XML metadata references external entities then reads local files, reaches internal network resources, or exhausts resources through entity expansion. The fix stops suppressing the failure and hardens the XML parser configuration.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run PHP before 8.0 and parse media files whose XML metadata is user controlled.
Background info
james-heinrich/getid3 is vulnerable to XML External Entity (XXE) Injection in versions 0.0.1 - 1.9.26.
How to fix this
Upgrade the james-heinrich/getid3 library to the patch version.
Links
GitHub Release
Related Issue
Other
github.com/JamesHeinrich/getID3github.com/JamesHeinrich/getID3/blob/0bc49beff9c274f2490ce9a4bb76f5ef50881e08/getid3/getid3.lib.php#L742-L755
vulncheck.com/advisories/getid3-through-1.9.26-xml-external-entity-injection-via-xml2array
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.