CVE-2016-15044
Kaltura < 11.1.0-2 PHP Object Injection RCE
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jul 23, 2025
- Updated
- Jul 15, 2026
- Reserved
- Jul 22, 2025
Description
A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user-controlled data within the keditorservices module. An unauthenticated remote attacker can exploit this issue by sending a specially crafted serialized PHP object in the kdata GET parameter to the redirectWidgetCmd endpoint. Successful exploitation leads to execution of arbitrary PHP code in the context of the web server process.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Video PlatformKaltura |
|
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/kaltura_unserialize_rce.rbexploit
- https://www.exploit-db.com/exploits/39563exploit
- https://www.exploit-db.com/exploits/40404exploit
- https://www.vulncheck.com/advisories/kaltura-php-object-injection-rcethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.