The getID3 library versions up to 1.9.26 contain an improper restriction of XML external entity references in the XML2array helper function. On PHP versions prior to 8.0, entity loading is not properly disabled, enabling attackers to embed malicious XML metadata within media files. Exploitation can lead to local file disclosure, SSRF, or DoS through entity expansion attacks. The vulnerability has a CVSS 4.0 score of 8.3, indicating high severity. No vendor advisory or patch information is provided in the input data.

Successful exploitation can disclose sensitive local files, enable server-side request forgery, or cause denial of service conditions. The impact is significant due to the potential for information disclosure and service disruption. No known exploits in the wild are reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should verify if a patch or update is available for getID3 beyond version 1.9.26 or consider upgrading PHP to version 8.0 or later where entity loading is properly handled. Until an official fix is confirmed, avoid processing untrusted XML metadata with vulnerable versions.