Executive brief
Kaltura's HTML5 video player library (used for embedding and playing videos on web applications) contains a critical vulnerability that allows attackers to execute arbitrary code on the server without authentication. By exploiting unsafe handling of user-supplied data combined with directory traversal, an attacker can write malicious PHP files to web-accessible directories and take control of the entire video platform, accessing customer data and deploying persistent backdoors.
Technical details
The vulnerability stems from two chained flaws in mwEmbedLoader.php: (1) unsafe deserialization via PHP's unserialize() function on data fetched from an attacker-controlled ServiceUrl parameter, and (2) insufficient sanitization of the uiconf_id parameter when constructing filesystem cache paths. An attacker can supply a malicious serialized PHP object via ServiceUrl and use path traversal sequences (../) in uiconf_id to write the deserialized object fields to a web-accessible directory. The resulting PHP file can then be directly requested to achieve remote code execution as the web-server user. No authentication or session tokens are required. The vulnerability affects html5lib v2.45, v2.103, and earlier v2.x releases; Kaltura Player V7 is unaffected. A memcache-only backend may prevent file writes but does not eliminate the unsafe deserialization itself.
Affected products
- Kaltura HTML5 Player (html5lib / mwEmbed) v2.45, v2.103 and earlier, other v2.x releases
Timeline
- 2026-08-25: disclosed: CVE-2026-19912 published; CERT/CC VU#308749 issued
- 2026-07-08: other: Vendor notified by researcher Gerjan Wemekamp (AndDone)