Kaltura HTML5 Player Flaws Enable Unauthenticated RCE
Two unpatched deserialization bugs in Kaltura's mwEmbed/html5lib let unauthenticated attackers read files and achieve remote code execution.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC has published an advisory on two related vulnerabilities in Kaltura's HTML5 player library (mwEmbed/html5lib), both stemming from insecure PHP deserialization in the mwEmbedLoader.php endpoint. The endpoint accepts a user-controlled ServiceUrl parameter used to fetch backend API data, which is then passed to PHP's unserialize() without validating source, scheme, or content. CVE-2026-19913 allows an unauthenticated attacker to supply a file:// URL to read arbitrary local files, since deserialization failures reflect raw file contents back in error messages — potentially exposing database credentials, API keys, and other secrets. CVE-2026-19912 stems from insufficient sanitization of the uiconf_id parameter, which is used to construct a cache file path; directory traversal sequences in this parameter can redirect file writes outside the intended cache directory, enabling an attacker to plant a malicious deserialized PHP payload in a web-accessible location and achieve remote code execution as the web-server user, when the default file-based cache backend is in use.
Both flaws require no authentication or session token, only network access to the affected endpoint, and affect html5lib v2.45, v2.103, and other v2.x releases exposing mwEmbedLoader.php. Because the endpoint is also present on Kaltura's shared multi-tenant CDN infrastructure, exploitation could affect multiple customer tenants sharing the same hosts, not just individual installations. CERT/CC states it was unable to reach Kaltura to coordinate disclosure, so no vendor patch is currently available.
Defenders running Kaltura should restrict or disable external access to mwEmbedLoader.php and enforce a strict allow-list for the ServiceUrl parameter limiting it to known, legitimate backend API URLs. Given the pre-authentication nature of both vulnerabilities and the potential for full RCE combined with multi-tenant CDN exposure, and the absence of an available patch, this should be treated as a high-priority mitigation item pending vendor response.
Mentioned in this report
Detection guidance
mwEmbedLoader.php Exploitation with Local File Inclusion
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
HTTP requests to mwEmbedLoader.php endpoint with file:// scheme in ServiceUrl parameter, indicative of CVE-2026-19913 local file read attempt. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: mwEmbedLoader.php Exploitation with Local File Inclusion
description: Detects HTTP requests to Kaltura's mwEmbedLoader.php endpoint containing
file:// scheme in the ServiceUrl parameter, attempting to read arbitrary local files
via insecure PHP deserialization (CVE-2026-19913).
tags:
- attack.t1190
- attack.t1005
logsource:
category: proxy
detection:
selection:
c-uri|contains: file://
condition: selection
falsepositives:
- Legitimate debugging or testing accessing mwEmbedLoader.php with file:// URLs from
internal development networks
level: high
id: 00be5817-3b80-5f88-b596-aa426577fc5d
status: experimental
author: Vorant
mwEmbedLoader.php Directory Traversal in uiconf_id Parameter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
HTTP requests to mwEmbedLoader.php with directory traversal sequences (../ or ..\\ patterns) in the uiconf_id parameter, indicative of CVE-2026-19912 cache poisoning attempt. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: mwEmbedLoader.php Directory Traversal in uiconf_id Parameter
description: Detects HTTP requests to Kaltura's mwEmbedLoader.php endpoint containing
directory traversal sequences in the uiconf_id parameter, attempting to write malicious
cache files outside the intended directory (CVE-2026-19912).
tags:
- attack.t1190
logsource:
category: proxy
detection:
selection:
c-uri|contains: uiconf_id
traversal:
c-uri|contains:
- ../
- ..\\
- '%2e%2e%2f'
- '%2e%2e%5c'
condition: selection and traversal
falsepositives:
- Legitimate Kaltura administrative tools testing path handling with encoded traversal
patterns
level: high
id: 6cee3d8c-2780-5e6f-b980-2158a7cdde30
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/308749
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs