Summary
It was discovered that Kdenlive allowed dangerous proxy parameters when
processing attacker-controlled project files. An attacker could use this to
execute arbitrary commands via the MLT framework's ante/post consumer
properties.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 26.04 LTS 26.04:LTS | kdenlive | 4:25.12.3-0ubuntu1.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | mlt | 7.36.1-1ubuntu3.1 |
Vulnerabilities 1
-
Medium 6.5
Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.
References
-
report
https://ubuntu.com/security/CVE-2026-45184