CVE-2016-15044

Description

A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user-controlled data within the keditorservices module. An unauthenticated remote attacker can exploit this issue by sending a specially crafted serialized PHP object in the kdata GET parameter to the redirectWidgetCmd endpoint. Successful exploitation leads to execution of arbitrary PHP code in the context of the web server process.

PUBLISHED Reserved 2025-07-22 | Published 2025-07-23 | Updated 2026-05-15 | Assigner VulnCheck

Problem types

CWE-502 Deserialization of Untrusted Data

CWE-94 Improper Control of Generation of Code ('Code Injection')

Product status

Credits

Security-Assessment.com finder

References

www.exploit-db.com/exploits/39563 exploit

raw.githubusercontent.com/...http/kaltura_unserialize_rce.rb exploit

www.exploit-db.com/exploits/39563 exploit

www.exploit-db.com/exploits/40404 exploit

www.vulncheck.com/...sories/kaltura-php-object-injection-rce third-party-advisory

cve.org (CVE-2016-15044)

nvd.nist.gov (CVE-2016-15044)

Download JSON