CISA addresses Kaltura mwEmbedLoader issues enabling file read and RCE
The Kaltura HTML5 Player Library (mwEmbed / html5lib) has two vulnerabilities that use an insecure deserialization flaw to enable arbitrary file read and remote code execution. The highest-level impact is remote code execution and arbitrary local file disclosure by a network attacker.
The issues relate to Kaltura’s mwEmbedLoader.php endpoint exposed by the HTML5 player library. This endpoint accepts a user-controlled ServiceUrl parameter as the target URL for backend API requests, and the KalturaClientBase PHP client library fetches data from the provided URL and deserializes it using PHP’s unserialize() without validating source, scheme, or content. CVE-2026-19913 results from the insecure deserialization flaw combined with improper error-handling behavior: an attacker can supply a ServiceUrl value that points to a local file using a file:// path, which causes the client to fetch the local file contents and attempt to deserialize them; when deserialization fails, raw bytes are reflected back in the resulting error message, enabling file read of content accessible to the web-server user. CVE-2026-19912 is caused by insufficient sanitization of the uiconf_id parameter when it is appended to the base cache folder path during disk writes; because uiconf_id is user-controlled and unsanitized, an attacker can include directory traversal sequences such as ../ to redirect file writes outside the intended cache directory. When the default file-based cache backend is used, an attacker can direct ServiceUrl to a malicious serialized object containing executable PHP code, then supply a uiconf_id value that writes deserialized fields to a web-accessible directory, after which the attacker can request the file to achieve remote code execution as the web-server user. A memcache-only backend may suppress the file write and prevent the specific code-execution path, but the insecure deserialization behavior and the unsanitized path construction remain. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases that expose the vulnerable mwEmbedLoader.php endpoint. The CERT/CC document also includes an advisories context noting that CERT/CC could not reach Kaltura to coordinate the vulnerabilities.
These vulnerabilities allow a remote, unauthenticated attacker to read arbitrary local files and execute arbitrary commands as the web-server user. No authentication or a Kaltura session token is required to exploit either issue; the attacker only needs network access to the affected html5lib endpoint. CVE-2026-19913 can be used to obtain database credentials, administrative secrets, API keys, or other sensitive information hosted on the affected instance. Remote code execution through CVE-2026-19912 allows an attacker to modify or exfiltrate platform data, deploy tools for persistence and lateral movement, and further compromise affected Kaltura deployments. Because the affected endpoint is also exposed on Kaltura’s shared, multi-tenant CDN infrastructure, the vulnerabilities affect not only individual customer installations but also every tenant served by these shared hosts.
Unfortunately, CERT/CC was unable to reach Kaltura to coordinate these vulnerabilities. To reduce risk until a patch is available, users are advised to restrict or disable external access to the mwEmbedLoader.php endpoint, and enforce a strict allow-list for ServiceUrl that permits only known, legitimate backend API URLs.
Acknowledgements note thanks to Gerjan Wemekamp (AndDone) for researching and reporting the vulnerabilities, and the document states it was written by Molly Jaconski.
Source: kb.cert.org.