getID3 <1.9.26 OS Command Injection via Unescaped Filenames
CVE-2026-94106 Published on September 20, 2026
getID3 before 1.9.26 OS Command Injection via Unescaped Filenames
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
Vulnerability Analysis
CVE-2026-94106 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2026-94106 has been classified to as a Shell injection vulnerability or weakness.
Products Associated with CVE-2026-94106
Want to know whenever a new CVE is published for Getid3? stack.watch will email you.
Affected Versions
james-heinrich getid3:- Before 1.9.26 is affected.
- Version 1.9.26 is unaffected.