Unpatched Kaltura mwEmbed Flaws Allow Remote File Read and Code Execution

CERT/CC has disclosed two unpatched vulnerabilities in Kaltura’s HTML5 video player library, mwEmbed (also distributed as html5lib), that allow remote, unauthenticated attackers to read arbitrary files from a server and execute code. The flaws, CVE-2026-19913 (file read) and CVE-2026-19912 (remote code execution), both stem from unsafe deserialization in the mwEmbedLoader.php endpoint. No authentication or session token is required; only network access to the endpoint is needed.

The file read vulnerability (CVE-2026-19913) arises because the ServiceUrl parameter is used to fetch a URL, and the response is passed to PHP’s unserialize() without validation. By supplying a file:// path, an attacker can cause the server to read a local file, and the raw bytes are reflected in an error message. Researcher Gerjan Wemekamp demonstrated reading the Kaltura application configuration file, which contains plaintext database credentials and internal host references.

The RCE vulnerability (CVE-2026-19912) leverages the same deserialization flaw combined with a path traversal in the uiconf_id parameter. An attacker can point ServiceUrl to a malicious serialized object containing PHP code, and use traversal sequences to write the payload into a web-accessible directory, then execute it by requesting the file. The attack works with the default file-based cache backend; a memcache-only configuration may suppress the write but does not make the deployment safe.

No patch is available, and CERT/CC was unable to coordinate with Kaltura. Administrators are advised to block or remove the endpoint, allow-list ServiceUrl, reject traversal sequences in uiconf_id, deny PHP execution in cache directories, restrict outbound network access, and rotate credentials if exposed. The affected releases include html5lib v2.45, v2.103 and earlier, and other v2.x releases. No exploitation has been reported, and neither CVE is in CISA’s KEV catalog as of August 25, 2026.