{"id":"CVE-2026-123029","aliases":[],"cve":{"records":[{"id":"CVE-2026-123029","source":"mitre","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-05T06:45:37.176Z","published":"2026-11-05T06:45:37.554Z","modified":"2026-11-10T13:55:46.857Z"}],"publishers":[{"name":"mitre","role":"CNA","organizationId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","modified":"2026-11-05T06:45:37.554Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-10T13:55:46.857Z"}],"references":[{"url":"https://www.wowza.com/docs/xxe-allows-reading-local-files","tags":["vendor-advisory"],"source":"mitre"}],"weaknesses":[{"id":"CWE-611","description":"CWE-611 Improper Restriction of XML External Entity Reference","source":"mitre"}],"applicability":[{"source":"mitre","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wowza:streaming_engine:*:*:*:*:*:*:*:*","versionEndExcluding":"4.12.2"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-10T13:55:37.640721Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza…","titleSource":"mitre","descriptionSource":"mitre","description":"Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files with the privileges of the Wowza Streaming Engine process.","score":7.5,"severity":"high","published":"2026-11-05T06:45:37.554Z","modified":"2026-11-10T13:55:46.857Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Wowza","name":"Streaming Engine","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"4.12.2","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"mitre","url":"https://www.cve.org/CVERecord?id=CVE-2026-123029"}],"remediation":[],"references":["https://www.wowza.com/docs/xxe-allows-reading-local-files"],"sources":[{"name":"CVE","id":"CVE-2026-123029","modified":"2026-11-10T13:55:46.857Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123029"}],"assessments":[{"source":"mitre","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5}],"sourceAffected":[],"observedAt":"2026-11-10T14:11:18.448Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:05:34.570Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-05T08:05:30.899Z","attemptedAt":"2026-11-05T08:05:30.899Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-05T08:05:31.921Z","attemptedAt":"2026-11-05T08:05:31.921Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-05T08:05:31.922Z","attemptedAt":"2026-11-05T08:05:31.922Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-05T08:05:31.920Z","attemptedAt":"2026-11-05T08:05:31.920Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-123029","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123029","modified":"2026-11-05T07:17:26.057","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-05T08:05:30.899Z"},{"source":"ENISA EUVD","id":"EUVD-2026-117386","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117386","modified":"Nov 5, 2026, 6:45:37 AM","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-05T08:05:31.922Z"}],"aiSummary":{"text":"Wowza Streaming Engine before 4.12.2 processes XML external entities, allowing remote attackers to read local files with the privileges of the Wowza Streaming Engine process. The weakness is due to improper restriction of XML external entity references. Remote access is required to exploit this vulnerability.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-05T08:01:04.374Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123029"}]}}