Severity: Critical
Affected versions: WSE 4.12.1 and earlier
Fixed in: WSE 4.12.2
Known exploitation in the wild: None
What to do: Upgrade to Wowza Streaming Engine 4.12.2 or later. Upgrading is the only complete fix.
Summary
A remote client that can get Wowza Streaming Engine (WSE) to process crafted XML can make the server read local files, using the WSE process’s privileges.
This can expose configuration files and credentials stored on the host.
Am I affected?
You’re affected if both of these are true:
- You run WSE 4.12.1 or earlier.
- Your server is reachable by untrusted clients.
Your risk is lower if you run WSE as a non-root user.
If you can’t upgrade yet
These steps reduce your risk but don’t fully fix the vulnerability. Plan to upgrade as soon as you can.
1. Run WSE and WSE Manager as unprivileged users
Run each under its own dedicated service account instead of root. The server can then read only the files that account can access. See Run Wowza Streaming Engine as a named user.
2. Disable remote shared objects
Set SharedObjectReadAccess and SharedObjectWriteAccess to empty values in every application’s Application.xml and in the template, then restart the server.
- Each application:
[install-dir]/conf/[app-name]/Application.xml - Template:
[install-dir]/conf/Application.xml
<!-- Inside <Application> in Application.xml -->
<Client>
<Access>
<SharedObjectReadAccess></SharedObjectReadAccess>
<SharedObjectWriteAccess></SharedObjectWriteAccess>
</Access>
</Client>
Note: Remote shared objects are deprecated. They were built for Adobe Flash Player, which is no longer supported. Unless a legacy RTMP client depends on them, it’s safe to disable them.
3. Tighten firewall rules
Limit access to non-streaming ports, and allow only trusted clients.
Disclosure timeline
- Oct 12, 2026: Wowza received the report.
- Oct 30, 2026: Wowza released WSE 4.12.2 and published this advisory.
