Ethical Hacking News
Unpatched vulnerabilities in Kaltura's HTML5 video player library have been revealed, allowing remote attackers to read arbitrary files and execute malicious code. Kaltura administrators are advised to take immediate action to protect their systems and adhere to secure coding practices to prevent similar vulnerabilities from arising.
Unpatched vulnerabilities in Kaltura's HTML5 video player library allow remote attackers to read arbitrary files and execute malicious code. The vulnerabilities, CVE-2026-19913 and CVE-2026-19912, stem from unsafe deserialization in the `mwEmbedLoader.php` endpoint. Administrators must restrict or disable external access to the `mwEmbedLoader.php` endpoint and enforce strict allow-lists for the `ServiceUrl` parameter. Denying PHP execution in cache directories and restricting outbound network access from the application server are also recommended. Kaltura has faced criticism for its lack of transparency and cooperation with the CERT/CC.
Unpatched vulnerabilities in Kaltura's HTML5 video player library have been revealed by the CERT Coordination Center (CERT/CC), allowing remote attackers to read arbitrary files from a server and execute malicious code on it. This disturbing discovery highlights the precarious state of video platform security, leaving customers and administrators alike to grapple with the daunting task of ensuring the integrity of their systems.
The vulnerabilities, tracked as CVE-2026-19913 and CVE-2026-19912, stem from the same unsafe deserialization in the `mwEmbedLoader.php` endpoint of the `mwEmbed` player library, which Kaltura also distributes as `html5lib`. This shared vulnerability allows a remote, unauthenticated attacker to access the server without requiring authentication or a Kaltura session token. The attackers need only to have network access to the endpoint, rendering the defense strategy somewhat ineffective.
Furthermore, the CERT/CC has noted that neither of these vulnerabilities has been patched, and Kaltura's efforts to coordinate a fix have been thwarted. With the absence of a patch, administrators are left with a difficult decision: either disable the endpoint entirely or risk being exploited by the unpatched vulnerabilities. The latter option poses a significant threat to the security of Kaltura customers, as the remote attackers can exploit these vulnerabilities to access sensitive files and execute code on the server.
Gerjan Wemekamp, the researcher who discovered these vulnerabilities, has highlighted the severity of the issue. In a technical writeup, he demonstrated how to escalate the file-read vulnerability by retrieving the Kaltura application configuration at `/opt/kaltura/app/configurations/local.ini`, which contains plaintext database connection strings, admin and console passwords, and internal host references. This finding underscores the gravity of the situation, as the attackers can now access sensitive data and potentially compromise the entire system.
The second vulnerability, CVE-2026-19912, is equally concerning. It enables the deserialization of malicious serialized objects carrying executable PHP code, which can then be executed by the web-server user. This code-execution vulnerability is made possible by the `uiconf_id` request parameter, which is appended to the cache folder path without sanitization when the application writes to disk. An attacker can exploit this vulnerability by pointing `ServiceUrl` at a malicious serialized object, allowing them to access the cache directory and execute the code.
Wemekamp has emphasized that neither of these vulnerabilities is a result of any coding error or oversights by Kaltura. Rather, they stem from the unsafe deserialization mechanism used in the `mwEmbed` library. This highlights the importance of adhering to secure coding practices and regularly updating dependencies to prevent such vulnerabilities from arising.
In light of this discovery, Kaltura administrators are advised to take immediate action to protect their systems. The CERT/CC recommends restricting or disabling external access to the `mwEmbedLoader.php` endpoint, enforcing a strict allow-list for the `ServiceUrl` parameter that permits only legitimate backend API URLs. It also recommends rejecting `uiconf_id` values containing traversal sequences, absolute paths, or directory separators. Furthermore, administrators are advised to deny PHP execution in cache directories and restrict outbound network access from the application server.
Additionally, Kaltura has been criticized for its lack of transparency and cooperation with the CERT/CC. The researcher's timeline reveals a series of missed opportunities to report the vulnerabilities, with the first report sent to a vendor security contact on March 23, 2026, followed by resubmissions and escalations. The vendor's response has been described as "unknown," which has led to speculation about the vendor's priorities and commitment to addressing security vulnerabilities.
In conclusion, the unpatched Kaltura flaws represent a significant threat to video platforms and their customers. The CERT/CC's warning serves as a stark reminder of the need for vigilance and proactive security measures. It is imperative that administrators take immediate action to address these vulnerabilities and ensure the integrity of their systems.
Related Information:
https://www.ethicalhackingnews.com/articles/Unpatched-Kaltura-Flaws-Expose-Remote-Attackers-to-Unbridled-Access-A-Looming-Threat-to-Video-Platforms-ehn.shtml
https://thehackernews.com/2026/08/unpatched-kaltura-mwembed-flaws-could.html
https://nvd.nist.gov/vuln/detail/CVE-2026-19913
https://www.cvedetails.com/cve/CVE-2026-19913/
https://nvd.nist.gov/vuln/detail/CVE-2026-19912
https://www.cvedetails.com/cve/CVE-2026-19912/
Published: Wed Aug 26 08:59:26 2026 by llama3.2 3B Q4_K_M
