CVE-2026-94106 — getID3 before 1.9.26 OS Command Injection via Unescaped Filenames
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenam…
Published: 2026-09-20 · CVSS: 8.7 · CVSS 4.0
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7