Kaltura Video Player Has Two Unpatched Flaws Enabling Remote File Theft, Code Execution

The CERT Coordination Center has disclosed two critical vulnerabilities in Kaltura's HTML5 video player library that permit a remote attacker without credentials to extract arbitrary files from a server and run code on it. No fix is available, and CERT/CC reports it was "unable to reach Kaltura to coordinate these vulnerabilities." The flaws affect both individual customer installations and every tenant served by Kaltura's shared, multi-tenant CDN infrastructure.

The vulnerabilities, designated CVE-2026-19913 and CVE-2026-19912, both originate from the same unsafe deserialization weakness in the mwEmbedLoader.php endpoint of the mwEmbed player library, which Kaltura also ships as html5lib. Neither flaw requires authentication or a Kaltura session token — network access to the endpoint is the sole requirement. Affected releases include html5lib version 2.45, version 2.103 and earlier, and other version 2.x releases that expose the vulnerable endpoint. Researcher Gerjan Wemekamp of AndDone scored CVE-2026-19912 at 10.0 and CVE-2026-19913 at 9.1. CERT/CC published no score for either flaw, and neither CVE appeared in CISA's Known Exploited Vulnerabilities catalog as of August 25, 2026. No exploitation had been reported at the time of writing. The Hacker News verified against Kaltura's public server repository on August 25 that the file carrying the unserialize() call remains byte-identical across 21 release refs, from Jupiter-10.9.0 committed April 27, 2015, to West-23.5.0 committed August 13, 2026.

The file read vulnerability, CVE-2026-19913, begins with the ServiceUrl parameter, which mwEmbedLoader.php accepts and uses as the target URL for backend API requests. According to CERT/CC's vulnerability note, the KalturaClientBase PHP client fetches whatever that URL returns and passes it to PHP's unserialize() without validating the source, scheme, or content. Providing a file:// path forces the server to retrieve a local file instead of an API response, and the raw bytes of that file are reflected back inside the error message when deserialization fails. Wemekamp said in a technical writeup published Tuesday that he escalated the file read by retrieving the Kaltura application configuration at /opt/kaltura/app/configurations/local.ini, which holds plaintext database connection strings, admin and console passwords, and internal host references. The second flaw, CVE-2026-19912, converts the same deserialization into code execution through the uiconf_id request parameter, which is appended to the cache folder path without sanitization when the application writes to disk.

The code execution path works by pointing ServiceUrl at a malicious serialized object carrying executable PHP code, which the client then fetches and deserializes. A uiconf_id value containing traversal sequences such as ../ redirects the write outside the intended cache directory and into a web-accessible one, and requesting that file directly executes it as the web-server user. "The file-drop step depends on the file-based cache backend, which is the Kaltura default. A memcache-only configuration may suppress the write and therefore that specific RCE path. However, that does not make the deployment safe," Wemekamp noted. Because the affected endpoint is exposed on Kaltura's shared, multi-tenant CDN infrastructure, the vulnerabilities affect not only individual customer installations but also every tenant served by these shared hosts, according to CERT/CC. The researcher's timeline records a first report to a vendor security contact on March 23, 2026, re-sent from a corporate address on April 13, contact with the vendor's CISO on LinkedIn on May 23, and escalation through a national CERT on July 2. CERT/CC notified Kaltura on July 8, and the note lists the vendor's status for both CVEs as Unknown, with no statement received.

With no patched version to install, administrators running the player are advised to block or remove the endpoint at the WAF, reverse proxy, or CDN where legacy mwEmbed players aren't being served. CERT/CC recommends allow-listing ServiceUrl to permit only the deployment's own API host while rejecting non-HTTP(S) schemes, rejecting uiconf_id values containing traversal sequences, absolute paths, or directory separators, denying PHP execution in cache directories, and restricting outbound network access from the application server. Administrators should rotate everything in local.ini where the endpoint has been exposed, covering database credentials, admin and console passwords, partner secrets, and API keys. Kaltura stripped unsafe deserialization out of its codebase once before — in August 2017, weeks ahead of a Telekom Security advisory covering three flaws in the platform, the company shipped a commit that removed three unsafe unserialize calls, though that commit touched three files, none of which was KalturaClientBase.php. Organizations running multi-tenant platforms face a cascade of containment decisions when shared infrastructure holds vulnerabilities this deep. Coordinated disclosure timelines lose their power when the vendor goes silent and the only defense becomes operational restraint.