CVE-2016-15044CWE-502CWE-94

Kaltura < 11.1.0-2 PHP Object Injection RCE

Critical · published July 23, 2025

CVSS v4.0
9.3
EPSS
2%
Percentile
82.4
In the wild
Unconfirmed
What it is

A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user-controlled data within the keditorservices module. An unauthenticated remote attacker can exploit this issue by sending a specially crafted serialized PHP object in the kdata GET parameter to the redirectWidgetCmd endpoint. Successful exploitation leads to execution of arbitrary PHP code in the context of the web server process.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.02214 · 82.4th percentile
Weaknesses
CWE-502 · Deserialization of Untrusted Data; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-07-23T22:02Z
EPSS history
Timeline
  • 23 JUL 22:02Z
    Kaltura < 11.1.0-2 PHP Object Injection RCE
    cvelistv5