UnratedFix available

DEBIAN-CVE-2026-94106

Type: advisorySource: OSV1 source record

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.

Announced 20 Sept 2026Source revision 1

Original source ↗

DEBIAN-CVE-2026-94106

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-94106

php-getid3

Source reference: /affected/0/package/name

Affected versions: 1.9.22+dfsg-1
Source reference: /affected/0/versions
1.9.23+dfsg-1
Source reference: /affected/0/versions
1.9.24+dfsg-1
Source reference: /affected/0/versions
1.9.25+dfsg-1
Source reference: /affected/0/versions
1.9.26+dfsg-1
Source reference: /affected/0/versions
1.9.27+dfsg-1
Source reference: /affected/0/versions
2.0.0~beta1+dfsg-1
Source reference: /affected/0/versions
2.0.0~beta2-1
Source reference: /affected/0/versions
2.0.0~beta3-1
Source reference: /affected/0/versions
2.0.0~beta4+dfsg-1
Source reference: /affected/0/versions
2.0.0~beta5+dfsg-1
Source reference: /affected/0/versions
2.0.0~beta6+dfsg-1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

php-getid3

Source reference: /affected/1/package/name

Affected versions: 1.9.23+dfsg-1
Source reference: /affected/1/versions
1.9.24+dfsg-1
Source reference: /affected/1/versions
1.9.25+dfsg-1
Source reference: /affected/1/versions
1.9.26+dfsg-1
Source reference: /affected/1/versions
1.9.27+dfsg-1
Source reference: /affected/1/versions
2.0.0~beta1+dfsg-1
Source reference: /affected/1/versions
2.0.0~beta2-1
Source reference: /affected/1/versions
2.0.0~beta3-1
Source reference: /affected/1/versions
2.0.0~beta4+dfsg-1
Source reference: /affected/1/versions
2.0.0~beta5+dfsg-1
Source reference: /affected/1/versions
2.0.0~beta6+dfsg-1
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

php-getid3

Source reference: /affected/2/package/name

Affected versions: 1.9.23+dfsg-1
Source reference: /affected/2/versions
1.9.24+dfsg-1
Source reference: /affected/2/versions
1.9.25+dfsg-1
Source reference: /affected/2/versions
Fixed versions: 1.9.26+dfsg-1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "php-getid3",
      "purl": "pkg:deb/debian/php-getid3?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "1.9.22+dfsg-1",
      "1.9.23+dfsg-1",
      "1.9.24+dfsg-1",
      "1.9.25+dfsg-1",
      "1.9.26+dfsg-1",
      "1.9.27+dfsg-1",
      "2.0.0~beta1+dfsg-1",
      "2.0.0~beta2-1",
      "2.0.0~beta3-1",
      "2.0.0~beta4+dfsg-1",
      "2.0.0~beta5+dfsg-1",
      "2.0.0~beta6+dfsg-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-94106.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "php-getid3",
      "purl": "pkg:deb/debian/php-getid3?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "1.9.23+dfsg-1",
      "1.9.24+dfsg-1",
      "1.9.25+dfsg-1",
      "1.9.26+dfsg-1",
      "1.9.27+dfsg-1",
      "2.0.0~beta1+dfsg-1",
      "2.0.0~beta2-1",
      "2.0.0~beta3-1",
      "2.0.0~beta4+dfsg-1",
      "2.0.0~beta5+dfsg-1",
      "2.0.0~beta6+dfsg-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-94106.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.9.26+dfsg-1"
          }
        ]
      }
    ],
    "package": {
      "name": "php-getid3",
      "purl": "pkg:deb/debian/php-getid3?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "1.9.23+dfsg-1",
      "1.9.24+dfsg-1",
      "1.9.25+dfsg-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-94106.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #58687 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 18:15:48 GMT
Publisher date: Sun, 20 Sep 2026 12:17:06 GMT

Read the original announcement