Kdenlive versions before 26.04.1 allow a maliciously crafted project file to specify proxy settings that the application will use without validating the input. This flaw enables the program to configure its network proxy to point to arbitrary addresses, potentially causing data to be routed through attacker-controlled servers or exposing sensitive information. The weakness is a lack of input validation on proxy parameters supplied from untrusted source files.

The CNA vendor is KDE's Kdenlive. All releases earlier than 26.04.1 are affected, and any user running these versions on a platform that can open project files is susceptible to this issue.

The CVSS score of 6.5 indicates moderate overall risk, and no EPSS information is available, so the current likelihood of exploitation is unknown. The vulnerability is not yet listed in the CISA KEV catalog. Because the attacker must provide a crafted project file, the attack vector is typically local or remote file-based. An attacker can exploit this by convincing a user to open a malicious project file, after which the application may route traffic through unauthorized proxy servers, potentially exposing data or enabling further network attacks.