CERT/CC has disclosed two unpatched vulnerabilities in Kaltura's mwEmbed HTML5 video player library, tracked as CVE-2026-19913 and CVE-2026-19912. Both flaws originate from unsafe deserialization in the mwEmbedLoader.php endpoint. A remote, unauthenticated attacker could exploit these vulnerabilities to read arbitrary files from the server or execute arbitrary code. The vulnerabilities remain unpatched at the time of disclosure. The impact is significant given the widespread use of Kaltura's video platform in enterprise and educational environments. No active exploitation has been confirmed, but the unauthenticated nature of the attack vector increases risk considerably.
Two unpatched vulnerabilities (CVE-2026-19913 and CVE-2026-19912) exist in Kaltura's mwEmbed HTML5 video player library, specifically in the mwEmbedLoader.php endpoint. Both stem from unsafe PHP deserialization in KalturaClientBase.php. CVE-2026-19913 (CVSS 9.1) is an arbitrary file read: the ServiceUrl parameter accepts a file:// URI, causing the server to fetch a local file whose raw bytes are reflected back in a deserialization error message. This can be exploited to retrieve /opt/kaltura/app/configurations/local.ini, exposing plaintext database credentials, admin/console passwords, and internal host references. CVE-2026-19912 (CVSS 10.0) achieves remote code execution by chaining the same deserialization with the unsanitized uiconf_id parameter: an attacker points ServiceUrl at a malicious serialized PHP object, which is fetched and deserialized; then uiconf_id with path traversal sequences (../) redirects the cache write to a web-accessible directory, allowing the dropped file to be executed as the web-server user. The RCE path requires the file-based cache backend (Kaltura default); memcache-only configs may suppress the write. Neither vulnerability requires authentication or a session token. The vulnerable code (unserialize() call in KalturaClientBase.php) has been present since at least March 2014 and is byte-identical across 21 release refs from Jupiter-10.9.0 (April 2015) to West-23.5.0 (August 2026). The endpoint is exposed on both individual customer installations and Kaltura's shared multi-tenant CDN infrastructure. No patch is available; Kaltura has not responded to disclosure attempts.
1. Block or remove the mwEmbedLoader.php endpoint at the WAF, reverse proxy, or CDN where legacy mwEmbed players are not being served. 2. Allow-list the ServiceUrl parameter to permit only the deployment's own API host and reject non-HTTP(S) schemes (file://, etc.). 3. Reject uiconf_id values containing path traversal sequences (../), absolute paths, or directory separators. 4. Deny PHP execution in cache directories. 5. Restrict outbound network access from the application server to prevent payload fetching required for the RCE path. 6. Rotate all credentials stored in local.ini where the endpoint has been exposed, including database credentials, admin and console passwords, partner secrets, and API keys. 7. Monitor for anomalous requests to mwEmbedLoader.php, especially those with file:// in ServiceUrl or traversal sequences in uiconf_id. 8. Check if the deployment is exposed on Kaltura's shared multi-tenant CDN and take appropriate isolation steps. Note: No patch is currently available from Kaltura.
mwEmbedLoader.php, KalturaClientBase.php, deployment/uiconf/KalturaClientBase.php, /opt/kaltura/app/configurations/local.ini, ServiceUrl parameter with file:// scheme, uiconf_id parameter containing ../ path traversal sequences
