Two Unpatched Kaltura Flaws Can Read Server Files and Execute Code

• The Mess: Two vulnerabilities in Kaltura mwEmbed remain without a vendor fix and can potentially allow attackers to read arbitrary files and execute code remotely. One bug is bad. Two bugs that can be chained are worse — especially when there is still no patch to install.

The flaws are CVE-2026-19913 and CVE-2026-19912, both affecting Kaltura’s mwEmbed / html5lib library through the mwEmbedLoader.php endpoint. CERT/CC says a remote attacker needs no authentication and no Kaltura session token — network access to the vulnerable endpoint is enough.

First Bug: Read Files You Were Never Supposed to See

CVE-2026-19913 can expose arbitrary files accessible to the web-server user.

The vulnerable endpoint accepts a user-controlled ServiceUrl, fetches the requested resource and passes the result into unsafe PHP deserialization. By pointing it at a local file, an attacker can cause the server to retrieve local content and reflect it back through an error condition.

That potentially means access to:

• database credentials;
• API keys;
• administrator secrets;
• application configuration;
• internal paths;
• other sensitive files readable by the server process.

And once you can read the configuration, you may already have what you need for the next stage.

Second Bug: Turn the File Write Into RCE

CVE-2026-19912 adds the nastier half of the story.

CERT/CC describes insufficient sanitization of the uiconf_id parameter, allowing path traversal when data is written to disk. Combined with the unsafe deserialization behavior, this can allow a remote attacker to write attacker-controlled content outside the intended cache directory and, under affected configurations, achieve remote code execution as the web-server user.

So the chain can become:

Internet → vulnerable endpoint → read secrets → write malicious content → execute code.

No login.

No phishing.

No employee clicking an attachment.

The Patch Problem Is the Real Headache

There is currently no official vendor patch described in the CERT/CC vulnerability note. CERT/CC says it was unable to reach Kaltura to coordinate the disclosure and lists the vendor status as unknown. The vulnerabilities were publicly disclosed on August 25, 2026.

That means administrators don’t get the comfortable answer:

Update to version X.

Instead, the immediate workaround is to restrict or completely disable external access to mwEmbedLoader.php until a proper fix is available. CERT/CC also recommends a strict allow-list for ServiceUrl, permitting only known legitimate backend API URLs.

This Could Affect More Than One Server

The vulnerable component exists in Kaltura’s HTML5 player ecosystem, including html5lib v2.45, v2.103 and earlier, as well as other v2.x releases exposing the vulnerable endpoint.

CERT/CC also warns that the affected endpoint is exposed on Kaltura’s shared, multi-tenant CDN infrastructure, potentially extending the impact beyond individual self-hosted installations to tenants served through those shared hosts.

That is what makes this more interesting than another forgotten PHP application.

A bug inside a shared video platform can create a much larger blast radius.

Is It Being Exploited?

At the time of disclosure, there were no reported cases of active exploitation, and the CVEs were not listed in CISA’s Known Exploited Vulnerabilities catalog.

So let’s be precise:

This is not an active-exploitation story. Yet.

But it has all the ingredients attackers like:

unauthenticated access.

arbitrary file read.

potential RCE.

Internet-facing endpoint.

no official patch.

That’s enough to make it worth taking seriously.

What Administrators Should Do Now

Until Kaltura provides a fix:

• restrict or disable access to mwEmbedLoader.php;
• allow-list legitimate ServiceUrl destinations;
• block dangerous schemes and unexpected external destinations where possible;
• review logs for suspicious requests to the vulnerable endpoint;
• check for unexpected files in web-accessible locations;
• monitor unusual outbound connections from the Kaltura server;
• rotate credentials if sensitive configuration files may have been exposed.

And don’t assume that because the application is “just a video platform,” it isn’t worth attacking.

Servers storing media often also store:

user accounts.

API credentials.

database connections.

administrator secrets.

Bugstoday Opinion

This is one of those vulnerabilities where the lack of a patch makes the story.

If this were:

“Two Kaltura bugs fixed in version 2.104.”

Fine.

Patch and move on.

Instead, administrators currently have two serious vulnerabilities publicly documented by CERT/CC, including unauthenticated file read and a potential path to remote code execution, while the recommended defense is essentially:

hide or disable the vulnerable endpoint.

That’s not patch management.

That’s emergency containment.

Bugstoday verdict: CVE-2026-19913 can potentially let strangers read files from your Kaltura server. CVE-2026-19912 can potentially turn that access into code execution. No authentication is required, no official patch is available, and the vulnerable endpoint may already be exposed to the Internet. If you’re running affected Kaltura infrastructure, don’t wait for the perfect update button — reduce exposure now.