Kaltura mwEmbed Flaws Allow Remote File Reads and Code Execution

The CERT Coordination Center (CERT/CC) has disclosed two critical, unpatched vulnerabilities within Kaltura's widely-used HTML5 video player library, known as mwEmbed. These flaws, identified as CVE-2026-19913 and CVE-2026-19912, present a significant security risk, enabling remote, unauthenticated attackers to potentially access sensitive information and execute malicious code on affected servers. Both vulnerabilities originate from an unsafe deserialization process occurring within the mwEmbedLoader.php endpoint of the mwEmbed player. Deserialization is a process where data is converted from a format suitable for storage or transmission into an object that can be manipulated by a program. When this process is unsafe, it can allow an attacker to inject malicious code disguised as legitimate data, which the program then executes.

Kaltura is a video technology company that provides a comprehensive platform for video management, creation, and distribution, serving a broad range of clients including educational institutions, media companies, and enterprises. Its mwEmbed player is a JavaScript-based component designed to embed and play video content across various web platforms and devices. The widespread adoption of this player means that a large number of websites and applications could be vulnerable to exploitation. The CERT/CC, a division of the Software Engineering Institute at Carnegie Mellon University, serves as a national cybersecurity focal point, coordinating responses to computer security incidents. Their disclosure highlights the severity and potential impact of these unpatched flaws.

The implications of CVE-2026-19913 and CVE-2026-19912 are substantial. The ability for an attacker to read arbitrary files from a server could lead to the exposure of confidential data, such as user credentials, configuration files, or proprietary information. Furthermore, the capability to execute code on the server grants attackers a high level of control, potentially allowing them to install malware, steal data, disrupt services, or use the compromised server as a pivot point to attack other systems within the network. The fact that these vulnerabilities are unauthenticated means that an attacker does not need any prior access or login credentials to exploit them, significantly lowering the barrier to entry for malicious actors.

As of the disclosure, there is no publicly available patch or workaround provided by Kaltura to mitigate these vulnerabilities. This leaves organizations relying on the mwEmbed player exposed. Users and administrators are strongly advised to monitor Kaltura's official security advisories and channels for any updates or patches. In the interim, security professionals may consider implementing network-level controls, such as Web Application Firewalls (WAFs) with custom rules, to detect and block malicious deserialization attempts, or to restrict access to the mwEmbedLoader.php endpoint if possible, though this could impact video playback functionality. The CERT/CC has not yet provided specific technical details on exploitation, but the nature of the flaws suggests a high likelihood of successful attacks if left unaddressed.