CVE-2026-45184: Kdenlive SSRF Vulnerability

CVE-2026-45184 Overview

CVE-2026-45184 affects Kdenlive, the open-source video editor maintained by the KDE project. Versions prior to 26.04.1 accept dangerous proxy parameters embedded in project files. An attacker who supplies a crafted project file can abuse these parameters when the victim opens the file in Kdenlive. The flaw is tracked under CWE-829: Inclusion of Functionality from Untrusted Control Sphere. Exploitation requires local user interaction, specifically opening an attacker-controlled .kdenlive project file.

Critical Impact
Opening a malicious Kdenlive project file can result in execution of dangerous proxy generation parameters, leading to compromise of confidentiality and integrity on the local system.

Affected Products

Kdenlive versions before 26.04.1
KDE multimedia suite installations bundling vulnerable Kdenlive builds
Linux, Windows, and macOS distributions packaging Kdenlive prior to the fixed release

Discovery Timeline

2026-05-08 - KDE publishes Security Advisory 20260508-1
2026-05-09 - CVE-2026-45184 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-45184

Vulnerability Analysis

Kdenlive uses proxy clips to provide lower-resolution editing copies of source media. The proxy generation workflow reads parameters stored inside the project file and passes them to underlying media tooling. Versions before 26.04.1 did not adequately validate these parameters. An attacker who controls the project file can embed dangerous proxy parameter strings that change how external media commands are invoked. When a victim opens the project, Kdenlive processes the malicious parameters during proxy handling.

The issue is classified as inclusion of functionality from an untrusted control sphere [CWE-829]. The project file becomes a control channel rather than a passive data file. Exploitation depends on the victim opening the file and proceeding with proxy operations, which limits scale but remains realistic in collaborative video editing workflows.

Root Cause

The root cause is insufficient sanitization of proxy parameter fields parsed from .kdenlive project XML. KDE's fixes restrict the allowed parameter set so that attacker-supplied values cannot influence sensitive media tool invocations. The remediation commits are available at KDE commit 94042ddd and KDE commit c3999aac.

Attack Vector

The attack vector is local and requires user interaction. An attacker distributes a crafted Kdenlive project file through email, shared storage, collaboration platforms, or template repositories. When the victim opens the file and Kdenlive processes the embedded proxy parameters, the dangerous configuration is applied. Refer to KDE Security Advisory 20260508-1 for vendor-supplied details.

No verified exploit code is publicly available.
See the KDE security advisory and patch commits for technical specifics.

Detection Methods for CVE-2026-45184

Indicators of Compromise

Kdenlive project files (.kdenlive) received from untrusted sources containing unusual proxy_params or related attributes
Unexpected child processes spawned by the Kdenlive process during project load or proxy generation
Modifications to media transcoding command lines deviating from default Kdenlive presets

Detection Strategies

Inspect .kdenlive XML files for proxy parameter fields containing shell metacharacters, redirection, or non-standard flags
Monitor endpoint process trees for kdenlive spawning media tooling with arguments sourced from project files
Flag installations of Kdenlive at versions earlier than 26.04.1 through software inventory scans

Monitoring Recommendations

Alert when Kdenlive launches with project files originating from email attachments, browser downloads, or removable media
Track filesystem and network activity originating from Kdenlive child processes during proxy generation
Correlate Kdenlive version data with the KDE advisory to prioritize hosts requiring updates

How to Mitigate CVE-2026-45184

Immediate Actions Required

Upgrade Kdenlive to version 26.04.1 or later on all systems where it is installed
Do not open Kdenlive project files received from untrusted or unverified sources
Audit shared project repositories and remove project files of unknown provenance

Patch Information

KDE addressed the issue in Kdenlive 26.04.1. The fix lands in commits 94042ddd259551e4a7a5f6672329752972c84685 and c3999aacc6da54756f3df8aab03b900459562ecd. Distribution maintainers should backport these commits if shipping older Kdenlive branches. Verify the installed package version through the system package manager after applying updates.

Workarounds

Disable proxy clip generation in Kdenlive preferences until the patched version is installed
Open untrusted project files inside a sandboxed or disposable virtual machine
Restrict execution of Kdenlive to non-privileged user accounts to limit the blast radius of any successful exploitation

bash

# Verify the installed Kdenlive version meets or exceeds the fixed release
kdenlive --version

# Example package manager checks
dpkg -l | grep kdenlive   # Debian/Ubuntu
rpm -q kdenlive           # RHEL/Fedora
flatpak info org.kde.kdenlive  # Flatpak installs