{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/308749#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nThe Kaltura HTML5 Player Library (mwEmbed / html5lib) contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code execution. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases that expose the vulnerable `mwEmbedLoader.php` endpoint. Until a vendor patch is available, users are advised to restrict access to the affected endpoint or disable it entirely.\r\n\r\n### Description\r\nKaltura is an AI video platform that provides tools for video management, publishing, playback, and integration with web applications. Kaltura’s HTML5 player library exposes the `mwEmbedLoader.php` endpoint, which accepts a user-controlled `ServiceUrl` parameter as the target URL for backend API requests. The `KalturaClientBase` PHP client library fetches data from this URL and automatically deserializes it using PHP's `unserialize()` function without validating source, scheme, or content. \r\n\r\n**CVE-2026-19913** results from the combination of this unsafe deserialization flaw and improper error-handling behavior. An attacker can provide the location of a local file to `ServiceUrl` as a `file://` path, and the client will fetch the internal file's contents and attempt to deserialize them. When deserialization fails, the raw bytes are reflected back to the client in the resulting error message, enabling the attacker to read any file accessible to the web-server user.\r\n\r\n**CVE-2026-19912** is caused by insufficient sanitization of the parameter `uiconf_id`, which is appended to the base cache folder path when the application writes data to disk. Because this value is user-controlled and unsanitized, an attacker can supply values that include directory traversal sequences such as `../` to redirect file writes outside the intended cache directory. When the deployment uses the default file-based cache backend, an attacker can direct `ServiceUrl` to a malicious serialized object containing executable PHP code, then supply a `uiconf_id` path value that writes its deserialized fields to a web-accessible directory. The attacker can then request the file directly to achieve remote code execution as the web-server user. A memcache-only backend may suppress the file write and prevent this specific code-execution path, but the underlying unsafe deserialization behavior and unsanitized path construction remain present.\r\n\r\n### Impact\r\nThese vulnerabilities allow a remote, unauthenticated attacker to read arbitrary local files and execute arbitrary commands as the web-server user. No authentication or Kaltura session token is required to exploit either issue; an attacker only needs network access to the affected html5lib endpoint. \r\n\r\nCVE-2026-19913 can be abused to obtain database credentials, administrative secrets, API keys, or any other sensitive information hosted on the affected instance. Remote code execution achieved through CVE-2026-19912 allows an attacker to modify or exfiltrate platform data, deploy tools for persistence and lateral movement, and further compromise affected Kaltura deployments. Because the affected endpoint is also exposed on Kaltura's shared, multi-tenant CDN infrastructure, these vulnerabilities affect not only individual customer installations, but also every tenant served by these shared hosts.\r\n\r\n### Solution\r\nUnfortunately, the CERT/CC was unable to reach Kaltura to coordinate these vulnerabilities. To reduce risk until a patch is available, users are advised to restrict or disable external access to the `mwEmbedLoader.php` endpoint, and enforce a strict allow-list for `ServiceUrl` that only permits known, legitimate backend API URLs.\r\n\r\n### Acknowledgements\r\nThanks to Gerjan Wemekamp (AndDone) for researching and reporting these vulnerabilities. This document was written by Molly Jaconski.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/308749"},{"url":"https://anddone-git.github.io/2026/one-parameter-two-bugs/","summary":"https://anddone-git.github.io/2026/one-parameter-two-bugs/"}],"title":"Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers","tracking":{"current_release_date":"2026-08-25T16:58:54+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.45"}},"id":"VU#308749","initial_release_date":"2026-08-25 16:11:48.878814+00:00","revision_history":[{"date":"2026-08-25T16:58:54+00:00","number":"1.20260825165854.3","summary":"Released on 2026-08-25T16:58:54+00:00"}],"status":"final","version":"1.20260825165854.3"}},"vulnerabilities":[{"title":"The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction.","notes":[{"category":"summary","text":"The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize(), and the resulting object’s fields are written to a cache path derived from attacker‑supplied uiconf_id without proper path validation. An attacker can write arbitrary files into web‑accessible locations and achieve code execution as the webserver user. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint."}],"cve":"CVE-2026-19912","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#308749"}]},{"title":"The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.","notes":[{"category":"summary","text":"The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the client in an error message; this enables an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint."}],"cve":"CVE-2026-19913","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#308749"}]}],"product_tree":{"branches":[]}}