CVE-2026-19912: Input Validation
The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize(), and the resulting object’s fields are written to a cache path derived from attacker‑supplied uiconfid without proper path validation. An attacker can write arbitrary files into web‑accessible locations and achieve code execution as the webserver user. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kaltura HTML5 player (mwEmbed / html5lib)to a version that resolves this vulnerability.Fixed in 2.45 - Upgrade
Upgrade
Kaltura HTML5 player (mwEmbed / html5lib)to a version that resolves this vulnerability.Fixed in 2.103 - Configuration
Modify mwEmbedLoader.php so the ServiceUrl parameter is not attacker-controlled; only allow trusted, server-side configured ServiceUrl values, because ServiceUrl responses are passed to unserialize().
mwEmbedLoader.php ServiceUrl = Remove/disable user-controlled ServiceUrl (ensure it is not accepted from untrusted input) - Configuration
Change mwEmbedLoader.php to avoid passing the response from ServiceUrl to unserialize(); ensure safe deserialization or parsing so attacker-controlled data cannot be deserialized into executable objects.
mwEmbedLoader.php unserialize() usage = Do not unserialize attacker-controlled data - Configuration
Add proper path validation for cache path construction derived from attacker-supplied uiconf_id; ensure generated cache paths cannot be written to web-accessible locations (e.g., enforce base directory and reject traversal/absolute paths).
mwEmbedLoader.php (cache path construction) uiconf_id path handling = Validate and sanitize uiconf_id to prevent path traversal and enforce expected directory - Compensating control
Restrict write/execute impact by preventing the webserver user from writing to web-accessible locations (e.g., adjust filesystem permissions so cache/write targets used by mwEmbed/html5lib are not web-served).
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The vulnerable mwEmbedLoader.php endpoint must be exposed to the attacker. Exploitation is unauthenticated and relies on supplying a controlled ServiceUrl and uiconf_id.
Which deployments should be treated as affected?
Kaltura HTML5 player mwEmbed/html5lib deployments using v2.45, v2.103, or earlier are affected. Other v2.x releases may also be affected if they expose the vulnerable endpoint.
What access could successful exploitation provide?
An attacker can write arbitrary files to web-accessible locations and execute code as the webserver user.