Vendor

Kaltura

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 25, 2026 · last 20d ago

Timeline2 articles

Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

CERT/CC disclosed unpatched Kaltura mwEmbed flaws CVE-2026-19913 and CVE-2026-19912 allowing unauthenticated file reads and remote code execution.

CERT/CC disclosed two unpatched flaws in Kaltura's mwEmbed HTML5 player library, both rooted in unsafe deserialization in mwEmbedLoader.php and exploitable without authentication. CVE-2026-19913 (reporter-scored 9.1) reflects local file contents back via the ServiceUrl parameter, exposing secrets in local.ini; CVE-2026-19912 (reporter-scored 10.0) achieves PHP code execution by writing attacker-controlled objects into web-accessible directories via the uiconf_id parameter. No patch exists and CERT/CC could not reach Kaltura; affected releases include html5lib v2.45, v2.103 and earlier, with the shared multi-tenant CDN hosts also impacted. No exploitation or KEV listing was reported as of August 25, 2026.

The Hacker NewsAug 26, 11:55 UTC · 20d agoVulnerability CVE-2026-19913 CVE-2026-199121

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.

CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.

CERT/CC Vulnerability NotesAug 25, 16:11 UTC · 21d agoVulnerability

Related CVEsby mentions

CVE-2026-199129.8<1%
Unauthenticated RCE in Kaltura mwEmbed HTML5 Player
Kaltura's HTML5 player library (mwEmbed/html5lib) contains an unauthenticated remote code execution vulnerability (CVE-2026-19912) caused by unsafe PHP deserialization combined with unsanitized filesystem path construction in mwEmbedLoader.php. A remote attacker controls the ServiceUrl parameter, whose response is passed to unserialize(), and supplies a crafted uiconf_id so that fields of the resulting object are written to an attacker-influenced cache path without path validation, allowing arbitrary files to be written to web-accessible locations and code execution as the webserver user; the related advisory headline also notes the flaws could allow reading files. The flaw is rated CVSS 9.8 (critical), requiring no privileges or user interaction over the network. Any deployment serving an affected html5lib v2.x release, including v2.45, v2.103 and earlier, is affected. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and EPSS estimates only a 0.6% probability of exploitation within 30 days (46th percentile), indicating no confirmed exploitation yet.
· Kaltura mwEmbed HTML5 player (html5lib) v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable mwEmbedLoader.php endpointlarge
CVE-2026-199137.5<1%
Unauthenticated Local File Disclosure in Kaltura HTML5 Player (mwEmbed)
The Kaltura HTML5 player (mwEmbed/html5lib) fails to properly validate the ServiceUrl parameter in mwEmbedLoader.php, which is used as the base URL for a backend request and accepts non-HTTP schemes such as file://. An unauthenticated remote attacker can supply a file:// URL, and when the backend request raises an exception or error, the server deserializes the response and reflects its raw contents back to the client in an error message, disclosing arbitrary files readable by the web server user. An attacker gains read access to internal server files, which may include configuration files or credentials, with confidentiality impact only per the CVSS score. Any deployment exposing the vulnerable mwEmbedLoader.php endpoint is affected, including sites running html5lib v2.45, v2.103 and earlier, and other v2.x releases. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known; EPSS is low at 0.4%, though related reporting indicates additional unpatched mwEmbed flaws, possibly including code execution, may exist.
· Kaltura html5lib / mwEmbed HTML5 player (mwEmbedLoader.php) v2.103 and earlier (including v2.45) and other v2.x releases exposing the vulnerable mwEmbedLoader.php endpoint; no fixed release identified in available reportlarge

Appears with

vendor CERT/CC 2 organization The Hacker News 1 product html5lib 1 product KalturaClientBase 1 organization CERT/CC 1 product Kaltura Player V7 1 product mwEmbed 1 product Kaltura HTML5 Player V2 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.