Threats affecting pkg:github/getid3

getID3 versions up to 1.9.26 contain an XML external entity (XXE) injection vulnerability in the XML2array helper function when running on PHP versions before 8.0. This vulnerability allows attackers to craft malicious XML metadata in media files to potentially disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.

getID3 versions before 1.9.26 have an OS command injection vulnerability due to improper escaping of filenames in shell command strings. This allows attackers to craft malicious filenames with shell metacharacters that can execute arbitrary commands with the privileges of the process using getID3. The vulnerability is rated high severity with a CVSS score of 8.7.