Kaltura HTML5 Player Flaws Enable Unauthenticated RCE

Two unpatched deserialization bugs in Kaltura's mwEmbed/html5lib let unauthenticated attackers read files and achieve remote code execution.

CERT/CC has published an advisory on two related vulnerabilities in Kaltura's HTML5 player library (mwEmbed/html5lib), both stemming from insecure PHP deserialization in the mwEmbedLoader.php endpoint. The endpoint accepts a user-controlled ServiceUrl parameter used to fetch backend API data, which is then passed to PHP's unserialize() without validating source, scheme, or content. CVE-2026-19913 allows an unauthenticated attacker to supply a file:// URL to read arbitrary local files, since deserialization failures reflect raw file contents back in error messages — potentially exposing database credentials, API keys, and other secrets. CVE-2026-19912 stems from insufficient sanitization of the uiconf_id parameter, which is used to construct a cache file path; directory traversal sequences in this parameter can redirect file writes outside the intended cache directory, enabling an attacker to plant a malicious deserialized PHP payload in a web-accessible location and achieve remote code execution as the web-server user, when the default file-based cache backend is in use.

Both flaws require no authentication or session token, only network access to the affected endpoint, and affect html5lib v2.45, v2.103, and other v2.x releases exposing mwEmbedLoader.php. Because the endpoint is also present on Kaltura's shared multi-tenant CDN infrastructure, exploitation could affect multiple customer tenants sharing the same hosts, not just individual installations. CERT/CC states it was unable to reach Kaltura to coordinate disclosure, so no vendor patch is currently available.

Defenders running Kaltura should restrict or disable external access to mwEmbedLoader.php and enforce a strict allow-list for the ServiceUrl parameter limiting it to known, legitimate backend API URLs. Given the pre-authentication nature of both vulnerabilities and the potential for full RCE combined with multi-tenant CDN exposure, and the absence of an available patch, this should be treated as a high-priority mitigation item pending vendor response.

title: mwEmbedLoader.php Exploitation with Local File Inclusion
description: Detects HTTP requests to Kaltura's mwEmbedLoader.php endpoint containing
  file:// scheme in the ServiceUrl parameter, attempting to read arbitrary local files
  via insecure PHP deserialization (CVE-2026-19913).
tags:
- attack.t1190
- attack.t1005
logsource:
  category: proxy
  product: undefined
detection:
  selection:
    c-uri|contains: file://
  condition: selection
falsepositives:
- Legitimate debugging or testing accessing mwEmbedLoader.php with file:// URLs from
  internal development networks
level: high
id: 00be5817-3b80-5f88-b596-aa426577fc5d
status: experimental
author: Vorant

title: mwEmbedLoader.php Directory Traversal in uiconf_id Parameter
description: Detects HTTP requests to Kaltura's mwEmbedLoader.php endpoint containing
  directory traversal sequences in the uiconf_id parameter, attempting to write malicious
  cache files outside the intended directory (CVE-2026-19912).
tags:
- attack.t1190
logsource:
  category: proxy
  product: undefined
detection:
  selection:
    c-uri|contains: uiconf_id
  traversal:
    c-uri|contains:
    - ../
    - ..\\
    - '%2e%2e%2f'
    - '%2e%2e%5c'
  condition: selection and traversal
falsepositives:
- Legitimate Kaltura administrative tools testing path handling with encoded traversal
  patterns
level: high
id: 6cee3d8c-2780-5e6f-b980-2158a7cdde30
status: experimental
author: Vorant

Source reporting: https://kb.cert.org/vuls/id/308749