Unpatched Kaltura mwEmbed Bugs Let Attackers Read Files, Run Code

The CERT Coordination Center (CERT/CC) has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow remote, unauthenticated attackers to read arbitrary files from a server and execute arbitrary code. Tracked as CVE-2026-19913 and CVE-2026-19912, both flaws stem from an unsafe deserialization bug in the mwEmbedLoader.php endpoint of the mwEmbed player library, which Kaltura also distributes as html5lib. According to CERT/CC, no patch is available because the coordination center said it was "unable to reach Kaltura" before publication. Administrators are urged to restrict external access to the endpoint and enforce a strict allow-list for the ServiceUrl parameter that permits only legitimate backend API URLs.

The file read vulnerability, CVE-2026-19913, exploits the ServiceUrl parameter that mwEmbedLoader.php accepts as the target URL for backend API requests. The KalturaClientBase PHP client fetches whatever URL is supplied and passes the response directly to PHP's unserialize() without validating the source, scheme, or content. Supplying a file:// path causes the server to fetch a local file rather than an API response; when deserialization fails, the raw bytes of the fetched file are reflected back to the requester inside the error message. Gerjan Wemekamp, the AndDone researcher credited with reporting both flaws, said in a technical writeup that he escalated the bug by retrieving the Kaltura application configuration at /opt/kaltura/app/configurations/local.ini, which holds plaintext database connection strings, admin and console passwords, and internal host references. Operators should run a port scanner against their infrastructure to confirm the loader endpoint is not exposed to untrusted networks.

The second flaw, CVE-2026-19912, escalates the same deserialization primitive into full remote code execution by way of the uiconf_id request parameter, which is appended to the cache folder path without sanitization when the application writes to disk. An attacker points ServiceUrl at a malicious serialized object carrying executable PHP code; the client fetches and deserializes it, while a uiconf_id value containing traversal sequences such as ../ redirects the write outside the intended cache directory, enabling code execution. Because the affected endpoint is also exposed on Kaltura's shared, multi-tenant CDN infrastructure, CERT/CC warned that the vulnerabilities impact not only individual customer installations but every tenant served by these shared hosts. No exploitation had been reported at the time of writing, and neither CVE appeared in CISA's Known Exploited Vulnerabilities catalog as of August 25, 2026.

With no official patch forthcoming, defenders should prioritize compensating controls: disabling or firewalling external access to mwEmbedLoader.php, validating the ServiceUrl parameter against a hard-coded allow-list of legitimate backend hosts, and auditing any installations that expose the loader publicly. Organizations running affected Kaltura deployments should also harden transport security with an SSL/TLS checker review and use a WHOIS lookup to verify the ownership and exposure status of any shared hosts serving their content until Kaltura releases an upstream fix.