XML External Entity Processing Flaw in Wowza Streaming Engine
CVE-2026-123029

7.5HIGH

Key Information:

Vendor

Wowza

Status
Streaming Engine
Vendor
CVE Published:
5 November 2026

What is CVE-2026-123029?

An XML External Entity (XXE) vulnerability in Wowza Streaming Engine versions prior to 4.12.2 allows remote attackers to exploit the processor's handling of XML data. This flaw enables unauthorized access to local files on the server, which could lead to the exposure of sensitive information. Attackers can manipulate XML input to read files with the same privileges as the Wowza Streaming Engine process, posing a significant risk to application integrity and information security.

Affected Version(s)

Streaming Engine 0 < 4.12.2

References

https://www.wowza.com/docs/xxe-allows-reading-local-files
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.