CVE-2026-45184

MEDIUM

Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.

Affects 0 products across 1 vendor.

CVSS 3.16.5
EPSS0.2%
Percentile5th
PatchUnknown
CVSS Vector — Plain English Requires local access, high complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, full integrity impact.
CWE Weakness Definitions
CWE-829: CWE-829
Related Attack Patterns (CAPEC)
CAPEC-201 Serialized Data External Linking
via CWE-829
CAPEC-228 DTD Injection
via CWE-829
CAPEC-252 PHP Local File Inclusion
via CWE-829
CAPEC-263 Force Use of Corrupted Files
via CWE-829
CAPEC-538 Open-Source Library Manipulation
via CWE-829
Show all 13

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

Kdenlive versions prior to 26.04.1 are vulnerable to an issue where dangerous proxy parameters can be set via an attacker-controlled project file, potentially leading to arbitrary code execution or other malicious actions.

BSID: BS-2026-GLOBAL-153532-M • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-45184?
Kdenlive versions prior to 26.04.1 are vulnerable to an issue where dangerous proxy parameters can be set via an attacker-controlled project file, potentially leading to arbitrary code execution or other malicious actions.
What is the CVSS score for CVE-2026-45184?
CVE-2026-45184 has CVSS 6.5 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L. EPSS: 0.2%.
Is CVE-2026-45184 actively exploited?
No confirmed active exploitation of CVE-2026-45184 as of 2026-05-30.
How do I remediate CVE-2026-45184?
Priority: MEDIUM.
What systems are affected by CVE-2026-45184?
CVE-2026-45184 affects Project.
Vulnerability Details
CVE IDCVE-2026-45184
BSIDBS-2026-GLOBAL-153532-M BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Published2026-05-09
Last Modified2026-05-13
ICS Relevance0%
Weakness (CWE)
CWE-829
SourceNVD
Official Description

Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can craft a malicious Kdenlive project file containing specially crafted proxy parameters. When a user opens this file in an affected version of Kdenlive, the application may execute these parameters, leading to unauthorized actions.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Project — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 159 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash0d6e39a53f44ca7b3c093db2a6cc970b70393a7865bb6bdbea20df692d2fc8d0b85bbb839c603ea9a5b44e09926848ef000ed8ac20f9436423354d6c3d1654a0
Related CVEs affecting Project
CVE-2026-45829 10.0 A pre-authentication, code injection vulnerability in version 1.0.0 or later ... CVE-2025-59823 9.9 Project Gardener implements the automated management and operation of Kuberne... CVE-2026-22797 9.9 An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 bef... CVE-2025-0987 9.9 Authorization Bypass Through User-Controlled Key vulnerability in CB Project ... CVE-2025-47282 9.9 Gardener External DNS Management is an environment to manage external DNS ent...
View all Project CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →