CVE-2026-19912: Kaltura HTML5 Player RCE Vulnerability

CVE-2026-19912 Overview

CVE-2026-19912 is an unauthenticated remote code execution vulnerability in the Kaltura HTML5 player (mwEmbed / html5lib). The flaw resides in mwEmbedLoader.php, which accepts a user-controlled ServiceUrl parameter and passes the fetched response to PHP's unserialize() function. The resulting object's fields are then written to a cache path built from an attacker-supplied uiconf_id value without path validation. An attacker can write arbitrary files into web-accessible locations and execute code as the webserver user. Affected releases include html5lib v2.45, v2.103 and earlier, along with other v2.x releases exposing the vulnerable endpoint.

Critical Impact
Unauthenticated attackers can achieve remote code execution on any server running the vulnerable Kaltura HTML5 player component.

Affected Products

Kaltura HTML5 player html5lib v2.45
Kaltura HTML5 player html5lib v2.103 and earlier
Other Kaltura mwEmbed v2.x releases exposing mwEmbedLoader.php

Discovery Timeline

2026-08-25 - CVE-2026-19912 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-19912

Vulnerability Analysis

The vulnerability combines two distinct weaknesses: insecure deserialization and unsanitized filesystem path construction. mwEmbedLoader.php acts as a remote resource loader, retrieving data from a URL controlled through the ServiceUrl request parameter. The endpoint requires no authentication.

After fetching the remote response, the loader passes its raw contents to PHP's unserialize() function. This triggers PHP object instantiation and can invoke magic methods such as __wakeup() and __destruct() on gadget chains present in the application's class hierarchy. The resulting object properties are subsequently written to a cache file whose path is derived from the attacker-supplied uiconf_id parameter.

Root Cause

Two compounding defects produce the exploit primitive. First, unserialize() is called on data that originates from an unauthenticated remote source, violating safe deserialization practice. Second, the cache write path incorporates uiconf_id without normalization or validation, permitting directory traversal sequences to redirect writes into web-accessible directories.

Attack Vector

An unauthenticated attacker issues an HTTP request to mwEmbedLoader.php with a ServiceUrl pointing to an attacker-controlled endpoint returning a crafted PHP serialized payload. The attacker simultaneously supplies a uiconf_id value containing path traversal characters to redirect the cache write to a location under the webroot. The deserialized object's field values become the file contents. Placing PHP code into a .php file under the webroot yields code execution as the webserver process when the file is subsequently requested. Refer to the CERT Vulnerability Advisory #308749 for technical detail.

Detection Methods for CVE-2026-19912

Indicators of Compromise

HTTP requests to mwEmbedLoader.php containing a ServiceUrl parameter referencing external or attacker-controlled hosts.
uiconf_id values containing path traversal characters such as ../, encoded variants (%2e%2e%2f), or absolute paths.
New or modified .php, .phtml, or .phar files under Kaltura cache directories or web-accessible paths.
Outbound HTTP requests originating from the webserver process to unusual destinations during ServiceUrl fetches.

Detection Strategies

Inspect web server access logs for requests to mwEmbedLoader.php with unusual ServiceUrl or uiconf_id parameter values.
Alert on PHP serialized data patterns (O: and a: prefixes) appearing in HTTP request or response bodies traversing the loader endpoint.
Monitor for webserver child processes spawning shells, curl, wget, or scripting interpreters immediately following requests to the loader.

Monitoring Recommendations

Enable file integrity monitoring on the Kaltura installation directory, web roots, and cache paths used by mwEmbed.
Log and review all outbound network connections initiated by the PHP-FPM or Apache worker process.
Correlate webserver process telemetry with file-write events to identify writes of executable content into web-accessible directories.

How to Mitigate CVE-2026-19912

Immediate Actions Required

Restrict network access to mwEmbedLoader.php at the reverse proxy or WAF layer until a patched build is deployed.
Block requests where the ServiceUrl parameter references external hosts or where uiconf_id contains traversal sequences.
Audit web-accessible directories for unauthorized .php files written after the endpoint was first exposed.
Rotate any credentials, API keys, or tokens accessible to the webserver process on affected hosts.

Patch Information

At time of publication, no vendor patch reference is listed in the CVE record. Consult the CERT Vulnerability Advisory #308749 for vendor coordination status and upgrade guidance. Administrators should track the Kaltura project repository for updated html5lib releases that remove the vulnerable loader logic.

Workarounds

Disable or remove mwEmbedLoader.php if the remote loading functionality is not required by the deployment.
Configure the webserver to deny execution of PHP files within cache directories using per-directory handler restrictions.
Deploy WAF signatures that reject requests to the loader containing serialized PHP payloads or traversal sequences in uiconf_id.
Run the webserver process under a least-privilege account with no write access to web-accessible directories.

bash

# Apache example: deny PHP execution within Kaltura cache paths
<Directory "/var/www/kaltura/html5/html5lib/cache">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx example: block direct access to the vulnerable loader
location ~* /mwEmbedLoader\.php$ {
    deny all;
    return 403;
}