Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code
CERT/CC disclosed two unpatched vulnerabilities (CVE-2026-19913 and CVE-2026-19912) in Kaltura's mwEmbed HTML5 video player library involving unsafe PHP deserialization CVE-2026-19913 (CVSS 9.1) enables unauthenticated arbitrary file read via the ServiceUrl parameter feeding file:// paths into unserialize(), reflecting raw file contents in error messages CVE-2026-19912 (CVSS 10.0) chains the same deserialization flaw with path traversal via uiconf_id to achieve unauthenticated remote code execut
Analysis
TL;DR
- CERT/CC disclosed two unpatched vulnerabilities (CVE-2026-19913 and CVE-2026-19912) in Kaltura's mwEmbed HTML5 video player library involving unsafe PHP deserialization
- CVE-2026-19913 (CVSS 9.1) enables unauthenticated arbitrary file read via the ServiceUrl parameter feeding file:// paths into unserialize(), reflecting raw file contents in error messages
- CVE-2026-19912 (CVSS 10.0) chains the same deserialization flaw with path traversal via uiconf_id to achieve unauthenticated remote code execution by dropping web shells
- No patch exists; CERT/CC was unable to reach Kaltura for coordination, and neither CVE appears in CISA's KEV catalog as of August 25, 2026
- The vulnerable code in KalturaClientBase.php has been byte-identical across 21 release refs spanning from 2014 to 2026, indicating a long-standing unaddressed flaw
Why It Matters
This vulnerability highlights the persistent danger of unsafe deserialization in widely deployed video infrastructure, affecting not only individual Kaltura installations but every tenant on Kaltura's shared multi-tenant CDN. The fact that the vulnerable code has remained unchanged for over a decade underscores the risks of legacy code persistence in production environments. For AI practitioners and security professionals, this serves as a stark reminder that third-party dependencies—even in non-AI-facing components like video players—can become critical attack vectors with unauthenticated RCE implications.
Technical Details
- Both flaws originate in mwEmbedLoader.php, which accepts a ServiceUrl parameter and passes its response through PHP's unserialize() without validating the source, scheme, or content via KalturaClientBase
- CVE-2026-19913: Supplying a file:// path to ServiceUrl causes the server to fetch local files; when deserialization fails, the raw bytes are reflected back in the error message, enabling reading of sensitive files like /opt/kaltura/app/configurations/local.ini (containing plaintext DB credentials and passwords)
- CVE-2026-19912: An attacker points ServiceUrl at a malicious serialized PHP object, then uses uiconf_id with path traversal sequences (e.g., ../) to redirect the deserialized write outside the cache directory into a web-accessible location, achieving RCE as the web-server user
- The RCE path depends on the file-based cache backend (Kaltura default); memcache-only configurations may suppress the write but do not eliminate the file-read vulnerability
- Affected releases include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the endpoint; the vulnerable unserialize() call has been byte-identical since at least March 2014
Industry Insight
- Organizations running Kaltura deployments should immediately restrict or block external access to the mwEmbedLoader.php endpoint at the WAF, reverse proxy, or CDN layer, and enforce strict allow-listing of ServiceUrl to only legitimate backend API hosts while rejecting non-HTTP(S) schemes
- Given the absence of a vendor patch and the multi-tenant exposure, shared CDN tenants should treat this as a critical risk requiring compensating controls such as denying PHP execution in cache directories and restricting outbound network access from application servers
- The decade-long persistence of this flaw in byte-identical form suggests systemic code review gaps; security teams should audit other legacy endpoints and third-party libraries for similar unsafe deserialization patterns, especially in components that may be overlooked in favor of core application logic
Disclaimer: The above content is generated by AI and is for reference only.