CVE-2026-123029 in Streaming Engine
Summary
by MITRE • 11/05/2026
Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in versions of Wowza Streaming Engine prior to version 4.12.2 constitutes a critical security flaw rooted in improper handling of Extensible Markup Language (XML) data, specifically classified under CWE-611 as an Improper Restriction of XML External Entity Reference. This weakness arises when the application processes untrusted XML input without adequately validating or sanitizing external entity declarations. In this specific instance, the streaming engine's parser allows for the definition and resolution of external entities that point to local file system resources rather than remote URIs. By crafting a maliciously structured XML payload containing an internal entity declaration that references absolute paths on the host operating system, an attacker can force the application to read arbitrary files from the server where Wowza Streaming Engine is deployed.
From a technical perspective, this vulnerability leverages the default behavior of many XML parsers which resolve external entities during parsing unless explicitly disabled or configured with secure processing flags. The flaw allows remote attackers who have access to the streaming engine's API or input endpoints to inject these malicious payloads. Once processed by the vulnerable version of Wowza Streaming Engine, the parser resolves the entity reference and returns the contents of the targeted local file within its response stream. This mechanism effectively bypasses standard operating system permissions relative to the user account running the application process, as the read operation is executed with the same privileges as the Wowza service itself.
The operational impact of this vulnerability is severe due to the potential for unauthorized data exfiltration and further system compromise. An attacker can use this capability to access sensitive configuration files that may contain database credentials, API keys, or other secrets necessary for deeper penetration into the network infrastructure. Additionally, reading log files might reveal internal IP addresses, server architectures, and operational details useful for planning subsequent attacks. In environments where Wowza Streaming Engine is integrated with backend systems such as databases or authentication services, obtaining these credentials could lead to a complete breach of confidentiality and integrity for those connected components. This aligns with the MITRE ATT&CK technique T1083, which covers File and Directory Discovery, allowing adversaries to map out critical assets on compromised hosts.
Mitigation strategies primarily involve upgrading Wowza Streaming Engine to version 4.12.2 or later, where this specific XML parsing vulnerability has been addressed through stricter input validation and secure configuration defaults. For organizations unable to immediately patch their systems due to operational constraints, implementing network-level controls such as web application firewalls can help detect and block malformed XML payloads containing external entity references before they reach the application layer. Furthermore, administrators should ensure that the Wowza Streaming Engine process runs under a least-privilege account with restricted file system access rights, limiting the potential damage if an exploitation attempt succeeds. Regular security audits of input handling mechanisms across all internet-facing services are also recommended to prevent similar XML-based injection vulnerabilities in other parts of the software stack.