CVE-2026-94106
Description
A flaw was found in getID3. This vulnerability allows an attacker with low privileges to inject arbitrary operating system (OS) commands. By crafting malicious filenames containing special shell characters, an attacker can exploit unescaped filenames in shell-out handlers, leading to the execution of arbitrary code with the privileges of the process embedding getID3.
Statement
This vulnerability is rated as Important because an authenticated user can trigger arbitrary OS command execution within the context of the underlying service account by submitting specially named media files. Although getID3 is not a core component of Red Hat Enterprise Linux, web applications or services that integrate this library to process untrusted file metadata can allow remote attackers to compromise the host system. The impact is limited to the system permissions granted to the web server or PHP runtime process.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
