getID3() before 1.9.8 as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to read arbitrary files cause a denial of service or possibly have other impact via an XML External Entity (XXE) attack.