Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code
-
Two unpatched vulnerabilities have been disclosed in Kaltura's HTML5 video player library, potentially allowing a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. The issues were reported by the CERT Coordination Center (CERT/CC) and both stem from the same unsafe deserialization flaw located in the
mwEmbedLoader.phpendpoint of the mwEmbed player. Because the flaws remain unpatched, there is currently no official fix available for affected deployments.- CVE-2026-19913 – Allows arbitrary file read on the server.
- CVE-2026-19912 – Allows remote code execution via the same vulnerable deserialization path.
Both vulnerabilities share a root cause, meaning a single successful exploit chain could potentially escalate from file disclosure to full code execution, depending on server configuration and the attacker's ability to reach the endpoint. The lack of a patch means administrators need to consider temporary mitigations, such as restricting access to the
mwEmbedLoader.phpendpoint via web application firewall rules or network-level controls, until an official update is released.The disclosure highlights a broader concern: third-party media libraries often run with elevated privileges on web servers, and a single unpatched component can undermine the entire hosting environment. It is advisable to audit any Kaltura-integrated systems for exposure to this endpoint and monitor for unusual requests targeting it.
Source: The Hacker News
Is your organization currently running Kaltura's mwEmbed player, and if so, what temporary controls are you putting in place while waiting for an official patch?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login