Kaltura Trusted One URL. It Became File Read and Remote Code Execution.

The flaws sit in mwEmbedLoader.php, an endpoint used by Kaltura’s second-generation HTML5 player. According to CERT/CC, an attacker needs only network access to the endpoint. No Kaltura session or access token is required. Public technical details and proof-of-concept material are available, although there is no confirmed evidence of malicious exploitation at the time of writing.

One parameter crossed three trust boundaries

The vulnerable endpoint accepts a user-controlled ServiceUrl. The player passes that value to KalturaClientBase, fetches the referenced content, and then hands the result to PHP’s unserialize() function without validating the source, scheme, or returned data.

That is already a dangerous chain. The same request also accepts a uiconf_id value that influences cache-path construction. Together, those design choices create separate read and write primitives inside a component that can be exposed directly to the internet.

CVE-2026-19913: local files can come back in the error response

With CVE-2026-19913, an attacker can supply a file:// URL as the service location. The server reads the chosen local path as the web-server user. When deserialization fails, the error response reflects the raw bytes that were read.

The practical impact depends on what the Kaltura service account can access. Configuration files, application secrets, credentials, source code and other locally readable material may all become targets. The vulnerability does not provide arbitrary access as root, but web applications often hold precisely the credentials and tokens attackers need for lateral movement.

CVE-2026-19912: cache traversal can become code execution

CVE-2026-19912 abuses the unsanitised uiconf_id parameter. Path-traversal sequences can escape the intended cache directory. On installations using the default file-backed cache, an attacker can place a malicious serialised object containing PHP code in a web-accessible location and then invoke it.

The resulting commands run with the privileges of the web-server account. That is not the same as full system compromise, but it gives an unauthenticated attacker an operating-system foothold and a direct path to application data, stored secrets and connected services.

Deployments configured exclusively with Memcached may avoid this specific file-write route because the cache entry is not written to disk. That configuration does not repair the underlying unsafe deserialisation or attacker-controlled path construction. It should be treated as a deployment-specific constraint on the published exploit chain, not as a complete fix.

Shared delivery infrastructure raises the stakes

CERT/CC warns that the vulnerable library may appear on shared or multi-tenant content-delivery infrastructure. That matters because the affected endpoint is not necessarily confined to a single, obviously branded Kaltura server. A centrally hosted player component can expand the exposure across customers that depend on the same delivery tier.

The advisory covers Kaltura HTML5 Player Library versions 2.45, 2.103 and earlier, as well as other version 2 deployments where mwEmbedLoader.php remains exposed. Administrators should inventory the endpoint directly rather than relying only on product-version banners.

There is no vendor patch yet

CERT/CC published VU#308749 on 25 August 2026 and said it had been unable to establish contact with Kaltura. The coordination note lists no vendor-supplied fixed version and no official patch. That leaves exposure reduction as the immediate defensive task.

Operators should:

• Disable or restrict external access to mwEmbedLoader.php wherever the endpoint is not required.
• Apply a strict allowlist to any legitimate ServiceUrl values.
• Block unexpected URL schemes, especially file://, before the value reaches server-side request handling.
• Search web logs for external requests to mwEmbedLoader.php, unusual ServiceUrl schemes, traversal sequences in uiconf_id, and follow-on requests to newly created PHP files.
• Review the permissions of the web-server account and rotate exposed application credentials if suspicious access is found.
• Check whether a shared CDN, hosted player service or vendor-managed deployment exposes the endpoint on the organisation’s behalf.

PoC availability changes the operational clock

The discoverer, Gerjan Wemekamp of AndDone, published a technical write-up describing the two exploit paths. That provides defenders with reproducible evidence, but it also shortens the path from advisory to working attacks.

The evidence status must remain precise. A public proof of concept is available. CERT/CC has validated the vulnerabilities and assigned a high overall severity to the coordination note. Neither CERT/CC nor Kaltura has confirmed active malicious exploitation, and no vendor patch was available when this article was prepared.

Sources

• CERT/CC VU#308749, first published 25 August 2026, publication time not provided; last revised 25 August 2026 at 16:58 UTC.
• AndDone technical write-up: One Parameter, Two Bugs, published 25 August 2026, publication time not provided.