Full Report
The CERT Coordination Center (CERT/CC) has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. The flaws, tracked as CVE-2026-19913 and CVE-2026-19912, both stem from the same unsafe deserialization in the mwEmbedLoader.php endpoint of the mwEmbed player
Analysis Summary
# Vulnerability: Critical Unsafe Deserialization in Kaltura HTML5 Video Player
## CVE Details
* **CVE ID:** CVE-2026-19912 (Remote Code Execution), CVE-2026-19913 (Arbitrary File Read)
* **CVSS Score:** 9.8 (Critical) - *Estimated based on remote unauthenticated RCE/LFI capabilities.*
* **CWE:** CWE-502: Deserialization of Untrusted Data
## Affected Systems
* **Products:** Kaltura HTML5 Video Player Library (mwEmbed)
* **Versions:** All versions incorporating the `mwEmbedLoader.php` endpoint prior to the official fix.
* **Configurations:** Systems where the `mwEmbed` library is publicly accessible and processes user-supplied input via the loader script.
## Vulnerability Description
Both vulnerabilities originate from a flaw in the `mwEmbedLoader.php` endpoint within the Kaltura mwEmbed player. The application performs unsafe deserialization on user-provided input.
* **CVE-2026-19912:** Allows for Remote Code Execution (RCE) by crafting malicious serialized objects that trigger arbitrary command execution upon being processed by the PHP engine.
* **CVE-2026-19913:** Leverages the same deserialization flaw to perform Arbitrary File Read (Local File Inclusion/LFI), allowing an attacker to retrieve sensitive system files or configuration data.
## Exploitation
* **Status:** PoC status not explicitly confirmed in brief, but disclosed by CERT/CC (High risk of imminent public PoC).
* **Complexity:** Low
* **Attack Vector:** Network (Remote, Unauthenticated)
## Impact
* **Confidentiality:** High (Full access to system files and database credentials)
* **Integrity:** High (Ability to modify application code or system files)
* **Availability:** High (Potential for full system takeover or service disruption)
## Remediation
### Patches
* **Status:** As per the disclosure, these were reported as **unpatched** at the time of initial CERT/CC disclosure. Users should monitor the official Kaltura GitHub repository and security advisories for emergency releases.
### Workarounds
* **Restrict Access:** If possible, restrict access to the `mwEmbedLoader.php` file via web server configuration (e.g., `.htaccess` or Nginx `location` blocks) to trusted IP addresses only.
* **WAF Rules:** Implement Web Application Firewall (WAF) rules to detect and block suspicious serialized PHP objects (e.g., strings starting with `O:`, `a:`, `s:`) sent to the `mwEmbedLoader.php` endpoint.
* **Disable Endpoint:** If the specific functionality of the loader is not critical to operations, consider renaming or disabling the file temporarily.
## Detection
* **Indicators of Compromise:**
* Unusual POST or GET requests to `mwEmbedLoader.php` containing encoded or serialized PHP strings.
* Web server logs showing access to `/mwEmbed/mwEmbedLoader.php` followed by unexpected outbound network connections.
* **Detection Methods:**
* Audit system logs for unauthorized file access (e.g., attempts to read `/etc/passwd`).
* Use Grep or YARA rules to scan web logs for the string `mwEmbedLoader.php`.
## References
* CERT/CC Vulnerability Note: hxxps[://]www[.]kb[.]cert[.]org/vuls/id/[PENDING]
* Kaltura Open Source: hxxps[://]github[.]com/kaltura/mwEmbed
* CVE Database: hxxps[://]cve[.]mitre[.]org/cgi-bin/cvename[.]cgi?name=CVE-2026-19912
* CVE Database: hxxps[://]cve[.]mitre[.]org/cgi-bin/cvename[.]cgi?name=CVE-2026-19913