---
id: CVE-2016-15044
title: >-
  A remote code execution vulnerability exists in Kaltura versions prior to
  11.1.0-2 due to unsafe deserialization of user-controlled data within the
  keditorservices module
summary: >-
  A remote code execution vulnerability exists in Kaltura versions prior to
  11.1.0-2 due to unsafe deserialization of user-controlled data within the
  keditorservices module. An unauthenticated remote attacker can exploit this
  issue by send…
severity: none
cwe:
  - CWE-94
  - CWE-502
published: '2025-07-23'
updated: '2026-07-15'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2016-15044'
references:
  - url: >-
      https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/kaltura_unserialize_rce.rb
    label: disclosure@vulncheck.com
  - url: 'https://www.exploit-db.com/exploits/39563'
    label: disclosure@vulncheck.com
  - url: 'https://www.exploit-db.com/exploits/40404'
    label: disclosure@vulncheck.com
  - url: 'https://www.vulncheck.com/advisories/kaltura-php-object-injection-rce'
    label: disclosure@vulncheck.com
  - url: 'https://www.exploit-db.com/exploits/39563'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - exploit-available
epss: 0.02038
epssPercentile: 0.79991
ingestedAt: '2026-07-15T13:44:02.872Z'
exploits:
  metasploit:
    - exploit/linux/http/kaltura_unserialize_rce
  checkedAt: '2026-09-21T15:26:54.567Z'
exploitAvailable: true
---

## Overview

A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user-controlled data within the keditorservices module. An unauthenticated remote attacker can exploit this issue by sending a specially crafted serialized PHP object in the kdata GET parameter to the redirectWidgetCmd endpoint. Successful exploitation leads to execution of arbitrary PHP code in the context of the web server process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.