Unauthenticated Remote Code Execution in Kaltura HTML5 Player

Executive Summary

CVE-2026-19912 is an unauthenticated remote code execution flaw in Kaltura's HTML5 player (mwEmbed/html5lib). It stems from unsafe deserialization of user-controlled input and unsanitized filesystem path construction. The mwEmbedLoader.php endpoint accepts a ServiceUrl parameter, whose response is deserialized without validation. The resulting object's fields are written to a cache path derived from an attacker-supplied uiconf_id parameter. This allows directory traversal attacks, enabling arbitrary file writes to web-accessible locations. Exploitation requires no authentication and can lead to full system compromise as the webserver user.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized files in web-accessible directories, especially those with unusual names or paths. Inspect network traffic for requests to mwEmbedLoader.php with suspicious uiconf_id or ServiceUrl parameters. Review server logs for unexpected file writes or deserialization errors.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on your server as the webserver user. They can write malicious files to web-accessible directories, modify or exfiltrate platform data, and deploy persistence tools. Since no authentication is required, any unauthenticated user can exploit it if the vulnerable endpoint is exposed. The impact includes complete system compromise, data theft, or further lateral movement within your network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security. GDPR mandates appropriate technical measures to ensure data integrity and confidentiality. HIPAA requires safeguards against unauthorized access or modification of protected health information. Exploitation could lead to data breaches, unauthorized access, or data integrity violations, resulting in potential fines or penalties for non-compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict external access to the mwEmbedLoader.php endpoint using firewall rules or network segmentation. Disable the endpoint if not required. Enforce strict allow-lists for ServiceUrl inputs to prevent malicious serialized objects. Monitor for unauthorized file writes in web directories.

Useful 0 Not Useful 0