Executive Summary
Two critical, unpatched vulnerabilities have been identified in the Kaltura HTML5 Player Library (mwEmbed / html5lib), exposing a broad spectrum of organizations—including universities, broadcasters, and enterprises—to the risk of remote file read and code execution attacks. These vulnerabilities, tracked as CVE-2026-19912 (Remote Code Execution) and CVE-2026-19913 (Arbitrary File Read), allow unauthenticated attackers to read sensitive files and execute arbitrary code on affected servers. Both vulnerabilities have received CVSS scores in the critical range (9.1–10.0). As of this advisory, no official patch is available, and over 600 internet-facing instances are exposed, including those on Kaltura’s own multi-tenant CDN infrastructure.
Technical Information
The vulnerabilities reside in the Kaltura HTML5 Player Library (mwEmbed / html5lib), specifically within the mwEmbedLoader.php endpoint. The first flaw, CVE-2026-19913, is an unauthenticated arbitrary file read vulnerability. It arises from the improper handling of the ServiceUrl parameter, which is user-controlled and allows the server to fetch and unserialize data from arbitrary URLs, including local files via the file:// scheme. If deserialization fails, the raw file contents are reflected in the error message, enabling attackers to read any file accessible to the web server user. This can expose highly sensitive files such as /etc/passwd or Kaltura’s configuration files (e.g., /opt/kaltura/app/configurations/local.ini), which may contain database credentials, administrative passwords, and API keys.
The second flaw, CVE-2026-19912, is an unauthenticated remote code execution (RCE) vulnerability. The uiconf_id parameter is appended to the cache directory path without proper sanitization, allowing directory traversal via sequences such as ../. When combined with the unsafe deserialization in ServiceUrl, an attacker can write a malicious PHP object to a web-accessible directory, resulting in a web shell and full RCE as the web server user. This enables attackers to execute arbitrary commands, modify or exfiltrate data, and establish persistent access.
Both vulnerabilities are remotely exploitable via HTTP(S) requests to the vulnerable endpoint and require no authentication or user interaction. The attack surface is significant, with over 600 internet-exposed instances identified through search engine reconnaissance, including those hosted on Kaltura’s own infrastructure.
Proof-of-concept exploitation is straightforward. For file read, an attacker can issue a GET request such as /html5/html5lib/v2.103/mwEmbedLoader.php?ServiceUrl=file:///etc/passwd, which returns the contents of /etc/passwd in the error message. For RCE, the attacker hosts a malicious serialized PHP object, sets ServiceUrl to their server, and uses uiconf_id with directory traversal to write the payload as a .php file in a web-accessible directory, then accesses the dropped web shell.
Exploitation in the Wild
As of the time of writing, there are no public reports of mass exploitation. The vulnerabilities were discovered during a bug bounty engagement and validated on a default Kaltura Docker container. However, the exposure and ease of exploitation make widespread attacks likely, especially given the number of internet-facing instances. Over 600 exposed instances have been identified via search engines. The vulnerabilities are not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and thus there is no CISA-confirmed active exploitation.
APT Groups using this vulnerability
There is no public evidence or open-source reporting attributing exploitation of these vulnerabilities to any specific Advanced Persistent Threat (APT) groups as of this advisory. However, the tactics, techniques, and procedures (TTPs) observed align with several MITRE ATT&CK techniques, including T1190 (Exploit Public-Facing Application), T1059 (Command and Scripting Interpreter via web shell), and T1005 (Data from Local System via file read). Organizations should remain vigilant for opportunistic and targeted exploitation attempts, as the vulnerabilities are highly attractive to both financially motivated and state-sponsored actors.
Affected Product Versions
The following versions of the Kaltura HTML5 Player Library (mwEmbed / html5lib) are affected:
All v2.x releases exposing the vulnerable mwEmbedLoader.php endpoint, including but not limited to v2.45 and v2.103. The vulnerable endpoint is present on both self-hosted and Kaltura’s multi-tenant CDN infrastructure. Organizations running any v2.x version of html5lib with public access to mwEmbedLoader.php are at risk.
Workaround and Mitigation
No official patch is available from Kaltura as of this report. Immediate mitigation steps are strongly recommended:
Restrict or disable access to mwEmbedLoader.php at the web server, reverse proxy, or CDN layer. Allow-list the ServiceUrl parameter to only permit legitimate backend API URLs and block non-HTTP(S) schemes such as file://. Sanitize the uiconf_id parameter to reject directory traversal, absolute paths, or directory separators. Deny PHP execution in cache directories to prevent web shell deployment. Restrict outbound network access from the application server to prevent fetching attacker-controlled payloads. Rotate all credentials stored in local.ini if compromise is suspected. Audit logs for suspicious requests and unexpected file creation, particularly in web-accessible directories.
Indicators of Compromise
Indicators of compromise are point-in-time and should be validated before enforcement. No public indicators of compromise were available at the time of writing.
References
AndDone Research Blog – One Parameter, Two Bugs, CERT/CC VU#308749, Rapid7 CVE-2026-19912, Reddit SecOpsDaily Discussion, The Hacker News Coverage, NVD CVE-2026-19913
Rescana is here for you
Rescana empowers organizations to manage third-party risk and supply chain security with our advanced TPRM platform, providing continuous monitoring, automated risk assessment, and actionable insights to help you stay ahead of emerging threats. For any questions or incident response support, we are happy to assist at info@rescana.com.
