CVE-2026-123029

{
  "etk_id": "ETK-2026-3594",
  "cve_id": "CVE-2026-123029",
  "display_id": "CVE-2026-123029",
  "ghsa_id": "GHSA-g54c-2vxv-4cp8",
  "euvd_id": "EUVD-2026-117386",
  "status": "published",
  "anchor_state": "anchored",
  "title": "XML external entity injection in Wowza Streaming Engine",
  "summary": "Wowza Streaming Engine versions before 4.12.2 are affected by an XML external entity injection flaw. An unauthenticated remote attacker may read local files accessible to the Streaming Engine process if they can submit XML that the engine processes.",
  "mitigation": "Upgrade Wowza Streaming Engine to version 4.12.2 or later. Until upgrading, restrict untrusted access to interfaces or workflows that accept and process XML.",
  "vendor": "Wowza",
  "product": "Streaming Engine",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 4.12.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.12.2"
      ],
      "package_name": "Streaming Engine",
      "purl": null
    }
  ],
  "cwes": [
    611
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 24.736342033333333,
  "t0_at": "2026-11-05T06:45:37.554000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-05T06:45:37.554000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T06:45:37.554000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-123029"
    }
  }
}