Unpatched Kaltura player vulnerabilities expose files and allow code execution on shared servers

Disclosure and contact timeline

CERT/CC disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library, also distributed as html5lib. Both affect the mwEmbedLoader.php endpoint and stem from unsafe deserialization. They allow an unauthenticated remote attacker to read arbitrary files from the server and execute code. The vulnerabilities are tracked as CVE-2026-19913 (file read) and CVE-2026-19912 (code execution).

Researcher Gerjan Wemekamp, known as AndDone, repeatedly attempted to contact Kaltura before public disclosure. The first report was sent on March 23, 2026 to a vendor security contact; it was re-sent from a corporate address on April 13. On May 23, the researcher contacted Kaltura's CISO on LinkedIn, then escalated through a national CERT on July 2. CERT/CC notified Kaltura on July 8. The vendor status for both CVEs remains "Unknown": no statement has been received and no patch exists. Kaltura's security.txt, updated May 28, 2024, points to HackerOne and [email protected], but sources do not specify which channel was used for the initial reports.

How the two vulnerabilities work

The first, CVE-2026-19913, exploits the ServiceUrl parameter. This parameter is used as the destination URL for backend API requests from the PHP client KalturaClientBase. The returned content is passed to unserialize() without any validation of origin, scheme, or content. Using a file:// scheme, an attacker can cause the server to read a local file: deserialization fails and the raw file bytes are reflected in the error message returned to the requester. Wemekamp used this technique to read /opt/kaltura/app/configurations/local.ini, a file that contains database credentials, admin and console passwords, and internal host references.

The second, CVE-2026-19912, targets writing to disk. The uiconf_id parameter is concatenated to the cache folder path without sanitization. By providing values with traversal sequences (../), the write is moved outside the cache into a web-accessible directory. Pointing ServiceUrl to a malicious serialized object containing executable PHP code, an attacker can cause the written file to later be requested and executed as the web server user. The RCE chain depends on the file-based cache backend, which is Kaltura's default; a configuration with only memcache can suppress the write, but does not make the deployment safe because file read via CVE-2026-19913 remains possible.

The researcher notes that he demonstrated a full web shell drop on the 2019 Kaltura Server Docker image. On the current release he verified that both halves of the chain are present and that deserialization is still executed.

Affected versions and exposure on shared hosts

CERT/CC lists html5lib v2.45, v2.103 and earlier as affected, along with other v2.x releases that expose the mwEmbedLoader.php endpoint. The file deployment/uiconf/KalturaClientBase.php, which contains the unserialize() call and error reflection, is byte-identical across 21 release refs: from Jupiter-10.9.0 (commit April 27, 2015) to West-23.5.0 (commit August 13, 2026). The vulnerable call already appears in a ref from March 10, 2014. Verification was performed by The Hacker News on August 25, 2026 against the public Kaltura server repository.

The endpoint is present on both customer installations and Kaltura's shared production hosts. As multi-tenant CDN infrastructure, exposure affects all tenants served by those hosts: a single compromised host can jeopardize data and applications of multiple organizations.

Impact and severity

An unauthenticated remote attacker can read sensitive files and achieve code execution without Kaltura session tokens or credentials. Potentially exfiltrated data includes database connection strings, admin and console passwords, partner secrets, and API keys. On shared hosts, the impact radius extends to all tenants.

The researcher assigns a CVSS of 10.0 to CVE-2026-19912 and 9.1 to CVE-2026-19913. The official recorded score for CVE-2026-19913 is 7.5. No official score is yet published for CVE-2026-19912. CERT/CC has not released its own scores, and as of August 25, 2026, no NVD records exist for the two CVEs.

Immediate mitigations

In the absence of a patch, administrators of Kaltura or html5lib installations can adopt several countermeasures. The first is to block or remove the mwEmbedLoader.php endpoint via WAF, reverse proxy, or CDN, especially where legacy mwEmbed players are no longer served. It is possible to apply an allowlist to the ServiceUrl parameter, allowing only the API host of your deployment and rejecting schemes other than HTTP(S). For uiconf_id, values with traversal sequences, absolute paths, or directory separators should be rejected. It is also advisable to deny PHP execution in cache directories and restrict outbound network access from the application server, since such access is necessary to download the payload.

Finally, if the endpoint has been exposed, all data contained in local.ini should be rotated: DB credentials, admin and console passwords, partner secrets, and API keys.

Patch status and prior incidents

As of August 25, 2026, no active exploitation was reported and neither CVE was listed in CISA's KEV catalog. The absence from KEV, however, does not reduce severity: these are vulnerabilities exploitable without authentication and with direct impact on data and code.

Kaltura has dealt with unsafe deserialization before. In August 2017, the vendor shipped a commit that removed three unsafe calls prior to a Telekom Security advisory on three vulnerabilities, fixed in release 13.2.0. That commit touched three files, none of which was KalturaClientBase.php: the current vulnerable code has remained unchanged for years. The case is part of a broader context: in July, Fastjson 1.x was also targeted in attacks with an improper deserialization that has no fix for the 1.x series. NIST stated in April that it no longer enriches every CVE, prioritizing KEV, federal government software, and critical software under EO 14028, which can delay the availability of official scores for vulnerabilities like these.