{
  "cveId": "CVE-2026-94106",
  "url": "https://patchblox.com/security/cve/CVE-2026-94106",
  "summary": "CVE-2026-94106 is fixed in php-getid3 on 1 platform by DEBIAN-CVE-2026-94106 (version 1.9.26\u002Bdfsg-1), released October 1, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "php-getid3: getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenam...",
  "description": "getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.",
  "published": "2026-09-20T12:17:06Z",
  "severity": "",
  "epss": 0.01664,
  "epssPercentile": 0.76879,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "php-getid3",
      "release": "Debian 14",
      "fixedVersion": "1.9.26\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2026-94106",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-94106",
      "released": "2026-10-01T20:52:30Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}