Unpatched Kaltura mwEmbed Flaws Allow Remote File Read and Code Execution

Two critical vulnerabilities affecting Kaltura's widely-used mwEmbed HTML5 video player library, also distributed as html5lib, have been disclosed by the CERT Coordination Center (CERT/CC). These flaws, tracked as CVE-2026-19913 and CVE-2026-19912, allow unauthenticated remote attackers to read arbitrary files from a server and execute arbitrary code. The vulnerabilities stem from an unsafe deserialization process within the mwEmbedLoader.php endpoint, a component exposed on both customer installations and Kaltura's own shared production infrastructure.

Neither vulnerability requires authentication or a Kaltura session token; only network access to the vulnerable endpoint is necessary for exploitation. Crucially, no patch is currently available, and CERT/CC has stated they were "unable to reach Kaltura to coordinate these vulnerabilities." This lack of vendor response leaves administrators in a precarious position, with CERT/CC recommending immediate mitigation steps such as restricting or disabling external access to the endpoint and enforcing strict allow-listing for the ServiceUrl parameter to permit only legitimate backend API URLs.

The file read vulnerability, CVE-2026-19913, is triggered by manipulating the ServiceUrl parameter. The mwEmbedLoader.php script uses this parameter to fetch data from a specified URL, which is then passed to PHP's unserialize() function without proper validation. By providing a file:// path, an attacker can trick the server into fetching a local file. While the deserialization attempt fails, the raw content of the fetched file is reflected back to the attacker within the resulting error message. Researcher Gerjan Wemekamp demonstrated that this could be used to retrieve sensitive configuration files, such as /opt/kaltura/app/configurations/local.ini, which may contain plaintext database credentials and administrative passwords.

The second flaw, CVE-2026-19912, leverages the same deserialization vulnerability to achieve remote code execution. This is accomplished by exploiting the uiconf_id request parameter, which is appended to a cache folder path without sanitization when the application writes data to disk. An attacker crafts a malicious serialized object containing executable PHP code and points the ServiceUrl parameter to it. The client fetches and deserializes this object. Subsequently, a crafted uiconf_id value containing directory traversal sequences (e.g., ../) can redirect the write operation outside the intended cache directory and into a web-accessible location. Accessing this dropped file directly then executes the malicious code as the web server user.

While the code execution path relies on Kaltura's default file-based cache backend, a configuration using only memcache might mitigate this specific RCE vector. However, the underlying deserialization vulnerability remains, and the file read capability persists. The researcher has assigned CVSS scores of 10.0 to CVE-2026-19912 and 9.1 to CVE-2026-19913, highlighting their severity. As of late August 2026, neither CVE appeared in CISA's Known Exploited Vulnerabilities (KEV) catalog, nor were there official NVD records.

Given the absence of a patch, administrators are strongly advised to implement several security measures. These include blocking the vulnerable endpoint at the WAF or reverse proxy level if legacy mwEmbed players are not actively served, and implementing strict allow-listing for the ServiceUrl parameter to accept only the deployment's own API host and reject non-HTTP(S) schemes. Additionally, it is recommended to reject uiconf_id values containing traversal sequences or directory separators, deny PHP execution within cache directories, and restrict outbound network access from the application server. Rotating all sensitive credentials found in local.ini, such as database passwords and API keys, is also a critical step.

The vulnerabilities affect html5lib versions v2.45, v2.103, and earlier, along with other v2.x releases that expose the vulnerable endpoint. The underlying unsafe deserialization flaw in KalturaClientBase.php has a long history, with similar issues being addressed in 2017. However, the specific call and error-message reflection mechanism appear to have persisted for years, impacting numerous releases. The lack of timely vendor response and patching for such critical vulnerabilities underscores the ongoing challenges in securing complex software supply chains.