PITTSBURGH, Sept. 2 — Researchers have disclosed two unpatched vulnerabilities in Kaltura’s HTML5 video player library that could let a remote, unauthenticated attacker read arbitrary files from a server and execute code on it. The flaws, tracked as CVE-2026-19913 and CVE-2026-19912, both stem from the same unsafe deserialization in the mwEmbedLoader.php endpoint of the mwEmbed player library, which Kaltura also distributes as html5lib. Neither vulnerability requires authentication or a Kaltura session token.
CERT/CC, which disclosed the issues, said network access to the endpoint is the only precondition. No patch is available, and CERT/CC said it was “unable to reach Kaltura to coordinate these vulnerabilities.” The advisory urges administrators to restrict or disable external access to the endpoint and to enforce a strict allow-list for the ServiceUrl parameter so it permits only legitimate backend API URLs.
The file read issue, CVE-2026-19913, starts with the ServiceUrl parameter, which mwEmbedLoader.php accepts and uses as the target URL for backend API requests. The KalturaClientBase PHP client fetches whatever that URL returns and passes it to PHP’s unserialize() without validating the source, the scheme, or the content. Supplying a file:// path causes the server to fetch a local file rather than an API response.
The deserialization attempt then fails, and the raw bytes of the fetched file are reflected back to the requester inside the resulting error message. Gerjan Wemekamp, the AndDone researcher credited with reporting both flaws, said in a technical writeup published Tuesday that he escalated the file read by retrieving the Kaltura application configuration at /opt/kaltura/app/configurations/local.ini, which holds plaintext database connection strings, admin and console passwords, and internal host references.
The second flaw, CVE-2026-19912, turns the same deserialization into code execution by way of the uiconf_id request parameter, which is appended to the cache folder path without sanitization when the application writes to disk. An attacker points ServiceUrl at a malicious serialized object carrying executable PHP code. A uiconf_id value containing traversal sequences such as ../ then redirects the write outside the intended cache directory and into a web-accessible one.
Requesting that file directly executes it as the web-server user. Wemekamp cautioned that a memcache-only configuration may suppress the file-drop step, “however that does not make the deployment safe.” The exposure is broader than individual customer setups. “Because the affected endpoint is also exposed on Kaltura’s shared, multi-tenant CDN infrastructure, these vulnerabilities affect not only individual customer installations, but also every tenant served by these shared hosts,” CERT/CC said in its vulnerability note.
The problem is not new to Kaltura’s codebase. The Hacker News verified against Kaltura’s public server repository on August 25 that deployment/uiconf/KalturaClientBase.php, the file carrying the unserialize() call, is byte-identical across 21 release refs, from Jupiter-10.9.0, committed on April 27, 2015, to West-23.5.0, committed on August 13, 2026.
The call and the error-message reflection appear earlier still, in a release ref committed on March 10, 2014. Kaltura has stripped unsafe deserialization out of its codebase before — in August 2017, weeks ahead of a Telekom Security advisory covering three flaws, the company shipped a commit that removed three unsafe unserialize calls, fixing those issues in release 13.2.0. That commit touched three files, none of which was KalturaClientBase.php.
Wemekamp was explicit about what he did and did not demonstrate. “To be exact about scope: the end-to-end web shell drop was demonstrated on the Kaltura Server docker image from 2019.
What I verified on the current release is that both halves of the chain are present, and that the deserialization half still executes as described,” he said.
