AI analysis
Kaltura's HTML5 player library (mwEmbed/html5lib) contains an unauthenticated remote code execution vulnerability (CVE-2026-19912) caused by unsafe PHP deserialization combined with unsanitized filesystem path construction in mwEmbedLoader.php. A remote attacker controls the ServiceUrl parameter, whose response is passed to unserialize(), and supplies a crafted uiconf_id so that fields of the resulting object are written to an attacker-influenced cache path without path validation, allowing arbitrary files to be written to web-accessible locations and code execution as the webserver user; the related advisory headline also notes the flaws could allow reading files. The flaw is rated CVSS 9.8 (critical), requiring no privileges or user interaction over the network. Any deployment serving an affected html5lib v2.x release, including v2.45, v2.103 and earlier, is affected. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS estimates only a 0.6% probability of exploitation within 30 days (46th percentile), indicating no confirmed exploitation yet.
What to do: No fixed version is identified in the available data and related coverage describes the flaws as unpatched, so apply the vendor's patched html5lib release as soon as it is available; in the meantime, restrict or block external access to mwEmbedLoader.php. Audit web-accessible cache directories for unexpected or recently modified files and review access logs for requests with unusual ServiceUrl or uiconf_id parameters that could indicate exploitation attempts.
Affected
| Kaltura mwEmbed HTML5 player (html5lib) | v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable mwEmbedLoader.php endpoint |
Estimated exposure
largelikely on the order of tens of thousands of deployments (exact count unknown) — Kaltura is a widely adopted enterprise video platform and mwEmbed is its default HTML5 player embedded across many education, media and enterprise sites, but no public install counts or scan data exist, so this is a deployment-pattern…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize(), and the resulting object’s fields are written to a cache path derived from attacker‑supplied uiconf_id without proper path validation. An attacker can write arbitrary files into web‑accessible locations and achieve code execution as the webserver user. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.