Executive brief
Kdenlive is a professional open-source video editing application. A security flaw allows a malicious project file to execute unauthorized commands or steal data when opened by a user. This could lead to a full system compromise if a user is tricked into opening a project file from an untrusted source.
Technical details
A vulnerability exists in Kdenlive's handling of proxy parameters within project files (CWE-829). The application failed to properly sanitize parameters passed to the underlying FFmpeg process during proxy clip generation. An attacker can craft a malicious project file containing dangerous FFmpeg arguments (such as -attach, -metadata, or protocol_whitelist) to achieve arbitrary code execution or file exfiltration. Exploitation requires a user to open a specially crafted .kdenlive project file. The issue is resolved in version 26.04.1 by implementing a blocklist for sensitive parameters and enforcing a strict protocol whitelist (file, pipe).
Affected products
- KDE Kdenlive < 26.04.1
Timeline
- 2026-04-03: other: Initial proxy parameter cleanup commit authored
- 2026-04-24: other: Parameter sanitization commit authored
- 2026-05-08: advisory: KDE Project Security Advisory released
- 2026-05-09: disclosed: CVE published to NVD