CVE-2026-19912

Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Remote Code Execution in Kaltura HTML5 Player

Publication date: 2026-08-25

Last updated on: 2026-09-03

Assigner: CERT/CC

Description

The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize(), and the resulting object’s fields are written to a cache path derived from attacker‑supplied uiconf_id without proper path validation. An attacker can write arbitrary files into web‑accessible locations and achieve code execution as the webserver user. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-09-03

Generated

2026-09-14

AI Q&A

2026-08-25

EPSS Evaluated

2026-09-13

NVD

CVE-2026-19912

EUVD

EUVD-2026-65614

Affected Vendors & Products

Vendor	Product	Version / Range
kaltura	html5_player_library	to 2.45 (exc)
kaltura	html5_player_library	From 2.45 (inc) to 2.103 (inc)
kaltura	html5_player_library	From 2.0 (inc) to 2.45 (exc)
kaltura	html5_player	to 2.103 (exc)
kaltura	html5_player	2.x

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-19912 is an unauthenticated remote code execution flaw in Kaltura's HTML5 player (mwEmbed/html5lib). It stems from unsafe deserialization of user-controlled input and unsanitized filesystem path construction. The mwEmbedLoader.php endpoint accepts a ServiceUrl parameter, whose response is deserialized without validation. The resulting object's fields are written to a cache path derived from an attacker-supplied uiconf_id parameter. This allows directory traversal attacks, enabling arbitrary file writes to web-accessible locations. Exploitation requires no authentication and can lead to full system compromise as the webserver user.

Detection Guidance

Check for unauthorized files in web-accessible directories, especially those with unusual names or paths. Inspect network traffic for requests to mwEmbedLoader.php with suspicious uiconf_id or ServiceUrl parameters. Review server logs for unexpected file writes or deserialization errors.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on your server as the webserver user. They can write malicious files to web-accessible directories, modify or exfiltrate platform data, and deploy persistence tools. Since no authentication is required, any unauthenticated user can exploit it if the vulnerable endpoint is exposed. The impact includes complete system compromise, data theft, or further lateral movement within your network.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security. GDPR mandates appropriate technical measures to ensure data integrity and confidentiality. HIPAA requires safeguards against unauthorized access or modification of protected health information. Exploitation could lead to data breaches, unauthorized access, or data integrity violations, resulting in potential fines or penalties for non-compliance.

Mitigation Strategies

Restrict external access to the mwEmbedLoader.php endpoint using firewall rules or network segmentation. Disable the endpoint if not required. Enforce strict allow-lists for ServiceUrl inputs to prevent malicious serialized objects. Monitor for unauthorized file writes in web directories.

Hi! I’m here to help you understand CVE-2026-19912. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70