The CERT Coordination Center (CERT/CC) has published information on two unpatched vulnerabilities in the Kaltura HTML5 video player library that allow a remote, unauthenticated attacker to read arbitrary files from the server and execute code on it. The issues are tracked as CVE-2026-19913 (arbitrary file read) and CVE-2026-19912 (remote code execution). No patch is available: according to CERT/CC, the coordination center was unable to contact Kaltura for coordinated disclosure. The problem affects not only standalone installations but also the vendor’s multi-tenant CDN infrastructure through which all customers are served on shared hosts. Administrators are advised to immediately block access to the vulnerable endpoint and rotate all credentials.
Technical details of the vulnerabilities
Both vulnerabilities stem from unsafe deserialization in the mwEmbedLoader.php endpoint of the mwEmbed library (also distributed as html5lib). According to CERT/CC, neither vulnerability requires authentication or a Kaltura session token — the only precondition for exploitation is network access to the endpoint.
CVE-2026-19913 — arbitrary file read
The mwEmbedLoader.php endpoint accepts a ServiceUrl parameter and uses it as the target URL for backend API requests. The PHP client KalturaClientBase fetches the content from the specified URL and passes it into the unserialize() function without validating the source, scheme, or content. If an attacker supplies a path with the file:// scheme, the server reads a local file instead of an API response. Deserialization fails with an error, and the raw file contents are returned in the error message. Researcher Gerjan Wemekamp from AndDone, who described both vulnerabilities in a technical report, assigned this issue a CVSS score of 9.1 (researcher’s score, not NVD).
CVE-2026-19912 — remote code execution
The second vulnerability turns the same deserialization into a code execution vector via the uiconf_id parameter. This parameter is appended to the cache directory path without sanitization when writing to disk. The attacker points ServiceUrl to a malicious serialized object containing executable PHP code. The client fetches and unserializes it. The uiconf_id value, which includes directory traversal sequences (for example, ../), redirects the write operation outside the cache directory into a web-accessible location. A direct request to this file results in its execution under the web server’s user account. The researcher assigned this vulnerability a CVSS score of 10.0.
According to Wemekamp, the file write stage depends on the file-based caching backend, which is Kaltura’s default configuration. A configuration that uses only memcache can suppress the write and therefore this specific RCE path; however, this does not make the deployment safe.
Affected versions: according to CERT/CC, html5lib v2.45, v2.103 and earlier, as well as other v2.x releases in which the vulnerable endpoint is present, are affected. As of August 25, 2026, neither CVE was listed in the CISA KEV catalog. NVD entries for both identifiers were also absent as of the same date. CERT/CC has not published its own CVSS scores.
Exploit status: active exploitation in the wild has not been confirmed, but the researcher’s public technical report effectively provides a description sufficient to reproduce the attack. The full chain, including placement of a web shell, was demonstrated on a 2019 Kaltura Server Docker image; the researcher stated that in the current release both parts of the chain are present and deserialization occurs as described.
Impact scope and historical context
The deployment architecture of Kaltura makes the situation particularly acute. As CERT/CC notes, the vulnerable endpoint is exposed not only on individual customer installations but also on the vendor’s shared multi-tenant CDN infrastructure. This means a compromise potentially affects all tenants served through these shared hosts.
Notably, Kaltura has addressed unsafe deserialization issues in the past. In August 2017 the company removed three unsafe unserialize calls and released a fix in version 13.2.0. However, that commit affected three files, none of which was KalturaClientBase.php — the file containing the current vulnerability. According to the source material, the unserialize() call in this file has been identical across 21 releases — from Jupiter-10.9.0 (April 2015) through West-23.5.0 (August 2026) — and first appeared back in March 2014.
Coordinated disclosure failure
The timeline of attempts to contact the vendor, as described by the researcher, is as follows: the first report was sent on March 23, 2026, a resend from a corporate address on April 13, an outreach to the vendor’s CISO via LinkedIn on May 23, and escalation through the national CERT on July 2. CERT/CC notified Kaltura on July 8. The vendor status for both CVEs in the CERT/CC entry is marked as “Unknown” — no response was received. At the same time, the Kaltura security.txt file (last updated May 28, 2024) directs vulnerability reports to a bug bounty program on HackerOne and lists the address [email protected].
Mitigation recommendations
In the absence of a patch, CERT/CC and the researcher recommend the following defensive measures:
- Block or remove the
mwEmbedLoader.phpendpoint at the WAF, reverse proxy, or CDN level — especially if legacy mwEmbed players are not in use. - Configure an allowlist for
ServiceUrlvalues, permitting only the deployment’s own API host and rejecting schemes other than HTTP(S). - Reject
uiconf_idvalues that contain directory traversal sequences, absolute paths, or directory separators. - Disallow PHP execution in cache directories.
- Restrict outbound network access from the application server — the code execution path requires downloading the payload from an external source.
- Rotate all secrets from
local.inion installations where the endpoint was accessible: database credentials, administrator and console passwords, partner secrets, and API keys.
The Kaltura situation clearly illustrates how lack of vendor response can turn coordinated disclosure into a de facto zero-day. The vulnerable code has existed in the codebase for more than 12 years, a public exploitation description is available, and no patch exists. Organizations using Kaltura — whether as a self-hosted installation or a cloud service — should immediately check whether the mwEmbedLoader.php endpoint is accessible, apply the listed mitigation measures, and rotate all credentials that may have been compromised through configuration file reads.
