<![CDATA[Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code]]>Two unpatched vulnerabilities have been disclosed in Kaltura's HTML5 video player library, potentially allowing a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. The issues were reported by the CERT Coordination Center (CERT/CC) and both stem from the same unsafe deserialization flaw located in the mwEmbedLoader.php endpoint of the mwEmbed player. Because the flaws remain unpatched, there is currently no official fix available for affected deployments.

  • CVE-2026-19913 – Allows arbitrary file read on the server.
  • CVE-2026-19912 – Allows remote code execution via the same vulnerable deserialization path.

Both vulnerabilities share a root cause, meaning a single successful exploit chain could potentially escalate from file disclosure to full code execution, depending on server configuration and the attacker's ability to reach the endpoint. The lack of a patch means administrators need to consider temporary mitigations, such as restricting access to the mwEmbedLoader.php endpoint via web application firewall rules or network-level controls, until an official update is released.

The disclosure highlights a broader concern: third-party media libraries often run with elevated privileges on web servers, and a single unpatched component can undermine the entire hosting environment. It is advisable to audit any Kaltura-integrated systems for exposure to this endpoint and monitor for unusual requests targeting it.

Source: The Hacker News

Is your organization currently running Kaltura's mwEmbed player, and if so, what temporary controls are you putting in place while waiting for an official patch?

]]>https://xploitlk.com/topic/162/unpatched-kaltura-mwembed-flaws-could-let-remote-attackers-read-files-and-run-codeRSS for NodeSat, 05 Sep 2026 13:29:09 GMTMon, 31 Aug 2026 04:30:26 GMT60