The getID3 library through version 1.9.26 contains an XML External Entity (XEE) flaw in its XML2array helper function. The function does not properly disable entity loading for PHP versions prior to 8.0, which allows an attacker to embed malicious XML declarations in the metadata of media files. This leads to disclosure of local files, the ability to perform server‑side request forgery (SSRF), or to trigger an external entity expansion attack that can exhaust server resources and cause a denial of service. The weakness is classified as CWE‑611 and has a CVSS score of 8.3, indicating high severity.

The vulnerability affects any installation of James Heinrich’s getID3 library that is version 1.9.26 or earlier. Applications that rely on getID3 to parse user‑supplied media metadata are therefore potentially impacted. No specific operating system or PHP version is required beyond PHP 7.x or earlier, which does not automatically disable entity loading.

The CVSS score of 8.3 reflects the significant impact this flaw can achieve if exploited. While the EXplicit EPSS score is not available, the absence of the flaw from the CISA KEV catalog suggests no confirmed exploitation at the time of this analysis, though the attack vector remains plausible. Attacks would typically require the ability to supply a crafted media file that is processed by getID3, which can occur through file uploads, downloads, or other ingestion mechanisms in affected web or media‑processing applications. The exploitation does not require elevated privileges and can be performed from a remote or local context depending on how the media file reaches the target system.