Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code
CERT/CC disclosed unpatched Kaltura mwEmbed flaws CVE-2026-19913 and CVE-2026-19912 allowing unauthenticated file reads and remote code execution.
CERT/CC disclosed two unpatched flaws in Kaltura's mwEmbed HTML5 player library, both rooted in unsafe deserialization in mwEmbedLoader.php and exploitable without authentication. CVE-2026-19913 (reporter-scored 9.1) reflects local file contents back via the ServiceUrl parameter, exposing secrets in local.ini; CVE-2026-19912 (reporter-scored 10.0) achieves PHP code execution by writing attacker-controlled objects into web-accessible directories via the uiconf_id parameter. No patch exists and CERT/CC could not reach Kaltura; affected releases include html5lib v2.45, v2.103 and earlier, with the shared multi-tenant CDN hosts also impacted. No exploitation or KEV listing was reported as of August 25, 2026.
- Both flaws need no authentication; network access to mwEmbedLoader.php suffices
- CVE-2026-19913: arbitrary file read exposing DB credentials and admin passwords in local.ini
- CVE-2026-19912: RCE via unsanitized uiconf_id path traversal into web-accessible cache dirs
- No patch available; mitigations include allow-listing ServiceUrl and blocking path traversal
- Vulnerable code byte-identical across releases from 2015 to August 2026
- Products
- mwEmbedhtml5libKalturaClientBase
- Organizations
- CERT/CCThe Hacker News
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19912 | Unauthenticated RCE in Kaltura mwEmbed HTML5 Player | 9.8 | <1% | ||
| CVE-2026-19913 | Unauthenticated Local File Disclosure in Kaltura HTML5 Player (mwEmbed) | 7.5 | <1% |
From the original article
4 min read at thehackernews.com
The CERT Coordination Center (CERT/CC) has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. The flaws, tracked as CVE-2026-19913 and CVE-2026-19912 , both stem from the same unsafe deserialization in the mwEmbedLoader.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.