Kaltura mwEmbed flaws leave servers open to file reads and code execution

CERT Coordination Center (CERT/CC) has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video-player library, mwEmbed, that can allow an unauthenticated remote attacker to read arbitrary files from a server and execute code. The issues are tracked as CVE-2026-19913 and CVE-2026-19912 and affect html5lib v2.45, v2.103 and earlier releases, as well as other v2.x deployments that expose the vulnerable endpoint.

Both flaws reside in mwEmbedLoader.php. CERT/CC said network access to the endpoint is the only stated precondition: attackers do not need a Kaltura session token or other authentication. No patch was available at disclosure, and CERT/CC said it had been unable to reach Kaltura to coordinate the vulnerabilities.

Unsafe deserialization enables file disclosure

CVE-2026-19913 arises from handling of the ServiceUrl parameter. The endpoint uses it as the destination for backend API requests, and KalturaClientBase fetches the returned content before sending it to PHP's unserialize() function. The code does not validate the URL source, scheme or returned content.

A supplied file:// path can therefore cause the server to retrieve a local file rather than an API response. While deserialization fails, the endpoint reflects the fetched raw bytes in its error message. Researcher Gerjan Wemekamp of AndDone reported retrieving /opt/kaltura/app/configurations/local.ini, which can contain plaintext database connection strings, administrator and console passwords, internal host references, partner secrets and API keys.

Cache path traversal creates an RCE route

CVE-2026-19912 uses the same unsafe deserialization behaviour for remote code execution. An attacker can set ServiceUrl to a resource that returns a malicious serialized object containing executable PHP code. The uiconf_id request parameter is appended to a cache-folder path without sanitization when the application writes data to disk.

Traversal sequences such as ../ in uiconf_id can redirect that write beyond the intended cache directory and into a web-accessible directory. Requesting the resulting file can then execute it as the web-server user. Wemekamp noted that the file-drop step depends on the file-based cache backend, which is Kaltura's default; a memcache-only setup may prevent that specific write, but does not eliminate the unsafe deserialization issue.

Shared infrastructure broadens the exposure

CERT/CC warned that the loader is present both on customer installations and Kaltura's shared production hosts. That means tenants on shared, multi-tenant CDN infrastructure may be affected alongside organisations operating their own deployments. As of August 25, 2026, neither CVE was listed in CISA's Known Exploited Vulnerabilities catalog, and no exploitation had been reported.

The researcher demonstrated an end-to-end web-shell drop on a 2019 Kaltura Server Docker image and said both parts of the chain remain present on the current release. The Hacker News also found that the KalturaClientBase file containing the unserialize() call was byte-identical across 21 release references, from Jupiter-10.9.0 in 2015 to West-23.5.0 in August 2026.

Controls to apply while no fix exists

Administrators should block or remove external access to mwEmbedLoader.php where legacy players are not required, using a WAF, reverse proxy or CDN. Where it must remain accessible, the ServiceUrl parameter should be restricted to legitimate internal API hosts and non-HTTP(S) schemes rejected.

Teams should also reject uiconf_id values containing traversal sequences, absolute paths or directory separators, deny PHP execution in cache directories and limit outbound network access from application servers. If the endpoint was exposed, the practical business implication is to rotate all secrets held in local.ini and treat the deployment as potentially vulnerable until access controls are verified.