Kaltura HTML5 Player Flaws Expose Servers to File Theft and Remote Code Execution

Cybersecurity researchers have disclosed two unpatched vulnerabilities in Kaltura’s HTML5 video player library that could allow remote, unauthenticated attackers to read sensitive files and execute malicious code on vulnerable servers.

Tracked as CVE-2026-19913 and CVE-2026-19912, the flaws affect the mwEmbedLoader.php endpoint in Kaltura’s HTML5 player library, also known as html5lib. Both vulnerabilities are caused by unsafe PHP deserialization.

What the vulnerabilities allow

CVE-2026-19913 can be exploited to read arbitrary files from the affected server. Researchers demonstrated retrieving Kaltura’s local.ini configuration file, which may contain database credentials, administrator passwords, API keys, and internal system information.

CVE-2026-19912 can potentially lead to remote code execution. By abusing unsafe deserialization together with a path traversal flaw, an attacker can place a malicious PHP file in a web-accessible location and execute it with the privileges of the web server.

The attacks do not require authentication or a Kaltura session token. Network access to the vulnerable endpoint is the primary requirement.

No patch currently available

CERT/CC said it was unable to reach Kaltura to coordinate a fix. As a result, administrators currently have no official patched version to install.

The vulnerabilities may also affect Kaltura's shared, multi-tenant infrastructure, potentially increasing the impact beyond individual customer installations.

No exploitation has been reported so far, and neither vulnerability was listed in CISA's Known Exploited Vulnerabilities catalog as of August 25, 2026.

Recommended mitigations

Organizations using the affected Kaltura HTML5 player should:

  • Block or disable mwEmbedLoader.php where it is not required.
  • Restrict ServiceUrl to trusted backend API URLs.
  • Reject non-HTTP(S) schemes such as file://.
  • Block path traversal characters in uiconf_id.
  • Disable PHP execution in cache directories.
  • Restrict outbound connections from affected servers.
  • Rotate credentials and API keys stored in local.ini if the endpoint was externally accessible.

The disclosure highlights the risks of legacy PHP components and unsafe deserialization, particularly when vulnerable endpoints are exposed directly to the internet.

Key Takeaway

Kaltura customers should treat these vulnerabilities as high priority because they are remotely exploitable without authentication and there is currently no official fix available. Until a patch is released, restricting access to the vulnerable endpoint and rotating potentially exposed credentials are the most important defensive measures.