Kaltura’s HTML5 video player library harbors two serious unpatched vulnerabilities—CVE-2026-19912 and CVE-2026-19913—that could let attackers read files from affected servers and even execute remote code. The CERT Coordination Center (CERT/CC) raised the alarm, noting both flaws stem from unsafe deserialization in the mwEmbed loader endpoint called mwEmbedLoader.php (also known as html5lib), which Kaltura distributes. These vulnerabilities require no authentication or session token—just network reachability to the endpoint.
How the Flaws Work
The first issue, CVE-2026-19913, abuses the ServiceUrl parameter. The mwEmbedLoader fetches data from whatever URL is supplied—without validating scheme, origin, or content—and passes the result through PHP’s unserialize(). If the supplied URL uses a file:// prefix, the server will read a local file. When the deserialization fails, the raw file content gets leaked via the error message. A researcher demonstrated this by accessing Kaltura’s local.ini, which contains plaintext credentials, host info, and admin passwords.
The second issue, CVE-2026-19912, combines the unsafe deserialization with unsanitized file writes. An attacker can send a crafted serialized object via ServiceUrl containing executable PHP code. Then, by manipulating the uiconf_id parameter with directory traversal (for example, using “../”), they can force the server’s cache write to drop the payload into a web-accessible location, which the attacker can then invoke. While a memcache-only cache backend blocks direct file writes (which would prevent that specific path to remote code execution), the researcher warns this doesn’t make affected deployments safe.
Which Versions Are Affected & Current Status
The vulnerabilities affect html5lib versions 2.45, 2.103, and all earlier v2.x releases exposing the vulnerable endpoint. There is presently no patch available.
These endpoints are present in both customer-hosted and shared multi-tenant infrastructure run by Kaltura. Because of how those shared environments are set up, every tenant using those shared hosts is at risk—not just isolated users. CERT/CC also reports that neither CVE is listed in the federal CISA Known Exploited Vulnerabilities (KEV) catalog as of August 25, 2026, and no active exploitation has been confirmed.
Mitigations Until a Fix Arrives
- Block or disable the
mwEmbedLoader.phpendpoint via web application firewall, reverse proxy, or CDN if legacy mwEmbed players are in use. - Enforce an allow-list for
ServiceUrlso only legitimate backend API URLs are accepted, and reject non-HTTP or non-HTTPS schemes. - Sanitize incoming
uiconf_idvalues to strip path traversal sequences, absolute paths, and directory separators. - Deny execution of PHP in cache directories to prevent malicious files dropped inside them from being invoked.
- Limit outbound network access from the application server, since the remote code path depends on fetching external payloads.
- Rotate all sensitive credentials in
local.ini(database strings, admin, console passwords, partner secrets, API keys) if the affected endpoint was exposed.
Reporter Timeline & Vendor Response
The researcher initially reported the flaws to Kaltura in March 2026. After repeating notifications in April and May, and involving national CERT bodies by July, CERT/CC reached out to Kaltura in early July. According to public records, Kaltura has not confirmed a patched version yet and has not published a clear statement on the vulnerabilities’ status.
Analysts verified malicious behavior persists in public source code. The unsafe unserialize() call in KalturaClientBase.php remains byte-identical in release refs going back to 2015 and up to the latest version from August 2026. Even if direct exploitation via web shells wasn’t shown in every deployment, both halves of the exploit chain—deserialization and file write—exist in current code bases.
Vulnerability severity scores reflect the risk: CVE-2026-19912 (remote code execution) has received a reporter-assigned score of 10.0, while CVE-2026-19913 (file read) was scored at 9.1. Cert/CC hasn’t released official scores. The National Vulnerability Database (NVD) doesn’t yet appear to list these CVEs as of August 25, 2026.
This issue joins a pattern of unsafe PHP deserialization flaws found elsewhere — including past incidents with Fastjson 1.x and earlier Kaltura fixes in 2017 — highlighting how failure to remove vulnerable unserialize calls continues to plague software ecosystems.
What to Watch Next
Patch development is the key. Any fix must remove unsafe deserialization completely, secure file write paths, and default configurations must deny risky behavior. Users should monitor Kaltura’s security channels for updates. Audits of existing installations are essential — operators need to confirm whether mwEmbedLoader is exposed, cache backend settings are safe, and credentials haven’t already been compromised.
