Description
Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| KDE | Kdenlive | < 26.04.1 | 26.04.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kdenlive | 26.04.1-1 | — |
| Debian 13 | kdenlive | 24.12.3-2+deb13u1 | — |
| Debian 12 | kdenlive | 22.12.3-2+deb12u2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | kdenlive | No fix yet | — |
| Ubuntu 26.04 LTS | kdenlive | 4:25.12.3-0ubuntu1.1 | USN-8856-1 |
| Ubuntu 26.04 LTS | mlt | 7.36.1-1ubuntu3.1 | USN-8856-1 |
| Ubuntu 25.10 | kdenlive | No fix yet | — |
| Ubuntu 24.04 LTS | kdenlive | No fix yet | — |
| Ubuntu 22.04 LTS | kdenlive | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | kdenlive | No fix yet | — |
| Ubuntu 18.04 LTS | kdenlive | No fix yet | — |
| Ubuntu 16.04 LTS | kdenlive | No fix yet | — |
Advisories 1
- USN-8856-1 kdenlive, mlt vulnerability Ubuntu Security Notices (USN) · Oct 1, 2026