CVE-2016-15044

CVE-2016-15044 is a critical remote code execution vulnerability affecting Kaltura versions prior to 11.1.0-2. This flaw stems from unsafe deserialization of user-controlled data within the keditorservices module, specifically when processing the kdata GET parameter sent to the redirectWidgetCmd endpoint. An unauthenticated attacker can exploit this with low complexity, leading to arbitrary PHP code execution in the context of the web server process, resulting in complete compromise of confidentiality, integrity, and availability. Exploit code, including a Metasploit module, is publicly available, and the vulnerability has garnered significant community discussion, indicating a high likelihood of exploitation.