{"id":"CVE-2026-123029","kind":"vulnerability","aliases":["CVE-2026-123029"],"related":[],"title":"Wowza Streaming Engine: XML external entities let remote attackers read local files","description":"Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process.","summary":"Wowza Streaming Engine before 4.12.2 parses XML with external entities enabled. A remote attacker can make it read local files with the privileges of the Wowza process.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","self-hosted","streaming","wowza-streaming-engine"],"not_affected_if":["version-4.12.2-or-later"],"how_to_check":"- Check the installed Wowza Streaming Engine version in the admin console or install directory, and compare it with `4.12.2`.","fix":"- Wowza Streaming Engine: move to `4.12.2` or later.","status":"open","published_at":"2026-11-05T07:17:26+00:00","first_seen_at":"2026-11-05T07:37:46+00:00","triaged_at":"2026-11-05T07:39:57+00:00","updated_at":"2026-11-05T07:39:57+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-05T07:39:57Z","model":"claude-haiku-5-5","output":{"fix":"- Wowza Streaming Engine: move to `4.12.2` or later.","reach":"internet","title":"Wowza Streaming Engine: XML external entities let remote attackers read local files","impact":"medium","summary":"Wowza Streaming Engine before 4.12.2 parses XML with external entities enabled. A remote attacker can make it read local files with the privileges of the Wowza process.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wowza-streaming-engine","self-hosted","streaming"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Local files readable by the Wowza process, possibly secrets and configuration","analyst_note":"","how_to_check":"- Check the installed Wowza Streaming Engine version in the admin console or install directory, and compare it with `4.12.2`.","plain_action":"","needs_analyst":false,"not_affected_if":["version-4.12.2-or-later"],"who_is_affected":"Any Wowza Streaming Engine server older than 4.12.2 that accepts XML input reachable from the network. Servers already on 4.12.2 or later are not affected by this flaw. The sources do not say whether a default configuration is exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000652,"input_tokens":4185,"output_tokens":467,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123029':15A,18A '-2026':14A,17A '4.12.2':32B,59C 'allow':65C 'attack':9A,41B,67C 'cve':13A,16A 'enabl':38B 'engin':3A,27B,30B,57C,79C 'entiti':6A,37B,63C 'extern':5A,36B,62C 'file':12A,47B,71C 'host':22B 'let':7A 'local':11A,46B,70C 'make':43B 'pars':33B 'privileg':50B,74C 'process':54B,60C,80C 'read':10A,45B,69C 'remot':8A,40B,66C 'runtim':19B 'self':21B 'self-host':20B 'stream':2A,23B,26B,29B,56C,78C 'wowza':1A,25B,28B,53B,55C,77C 'wowza-streaming-engin':24B 'xml':4A,34B,61C","nicknames":[],"mitigations":[],"who_affected":"Any Wowza Streaming Engine server older than 4.12.2 that accepts XML input reachable from the network. Servers already on 4.12.2 or later are not affected by this flaw. The sources do not say whether a default configuration is exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","runtime","selfhosted","streaming","wowzastreamingengine"],"campaign_type":null,"first_public_at":"2026-11-05T07:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123029","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123029","severity":null,"published_at":"2026-11-05T07:17:26+00:00","modified_at":"2026-11-05T07:17:26+00:00","first_seen_at":"2026-11-05T07:37:46+00:00","fetched_at":"2026-11-05T07:37:46+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}