Do Son 
The Kaltura HTML5 Player Library contains two critical, unpatched vulnerabilities. These issues allow attackers to read local files and execute arbitrary code. Researchers identified these Kaltura server flaws in the mwEmbedLoader.php endpoint. Administrators must apply manual mitigations immediately because no official vendor patch exists.
Why It Matters
These vulnerabilities grant unauthenticated remote attackers total control over affected web servers. Attackers can steal database credentials, administrative secrets, and critical API keys. They can also alter platform data or establish network persistence. Furthermore, these issues severely impact Kaltura’s shared CDN infrastructure. As a result, the security risk extends to every single tenant hosted on those shared systems.
Attack Mechanism
Both problems stem from an insecure deserialization process in the KalturaClient library. The vulnerable endpoint accepts a user-controlled ServiceUrl parameter. The server fetches data from this URL and calls PHP’s unserialize function. Crucially, the system does not validate the source, scheme, or content.
To exploit CVE-2026-19913, an attacker supplies a local file path. The application attempts to deserialize the internal file content. When this fails, the server reflects the raw file bytes back in the error message. Consequently, the attacker can read sensitive files.
For CVE-2026-19912, an attacker provides a malicious serialized object containing executable PHP code. They then use directory traversal sequences in the uiconf_id parameter. This forces the server to write the payload outside the standard cache directory. Finally, the attacker requests this web-accessible file directly to execute their code.
Affected Versions
These Kaltura server flaws impact html5lib version 2.45, version 2.103 and earlier. They also affect any other v2.x releases that expose the vulnerable endpoint. Currently, official sources do not confirm any active exploitation in the wild. Additionally, no public proof-of-concept exploit is currently available. User counts are unknown.
Mitigation Steps
The vendor has not released an official software update. Therefore, security experts advise users to restrict external access to the vulnerable endpoint. Alternatively, administrators can disable the endpoint entirely. The CERT/CC states that teams must “enforce a strict allow-list for ServiceUrl that only permits known, legitimate backend API URLs.”
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
