Wowza Streaming Engine versions prior to 4.12.2 process XML external entities without proper validation. This flaw can be exploited by sending a crafted XML document, allowing an attacker to cause the server to resolve an external entity reference that points to a file on the host system. The vulnerability enables reading arbitrary files that the Wowza process can access, which can expose sensitive configuration data, credentials, or code, compromising confidentiality and potentially the integrity of the application.

The affected product is Wowza Streaming Engine. All installations running a version older than 4.12.2 are impacted. Specific version details are not enumerated beyond the version threshold, so any deployment of the product prior to the 4.12.2 release is considered vulnerable.

The CVSS score of 7.5 classifies the flaw as high severity. No EPSS score is currently available, and the vulnerability is not listed in CISA KEV. The likely attack vector involves remote interaction via XML input supplied to the streaming engine; an attacker does not need prior authentication. Once successfully triggered, the attacker can read local host files with the privileges of the Wowza process, which could lead to further compromise.