Full research report
Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code
Executive assessment
Two critical vulnerabilities in Kaltura's mwEmbed PHP player library were disclosed without a vendor patch after five months of failed engagement — a combination that maximises the risk window for the estimated 630 exposed instances. The shared multi-tenant CDN scope is the most significant amplifying factor: because Kaltura's own production hosting exposes the same vulnerable endpoint, a single exploitation event could affect multiple customer tenants simultaneously rather than being confined to one self-hosted deployment. The CVSS 10.0 rating on CVE-2026-19912 reflects the zero-authentication, network-accessible remote code execution primitive; the chained file-read in CVE-2026-19913 compounds the risk by exposing plaintext database credentials and administrative secrets, creating a clear path from initial access to full credential compromise. No active exploitation or threat actor attribution has been reported as of the disclosure date, and no public standalone exploit code exists — however, the researcher's detailed writeup with validated PoC on current release code means capable adversaries can reproduce both attack chains without independent vulnerability research.
What happened
On 25 August 2026, CERT/CC publicly disclosed two critical unpatched vulnerabilities in Kaltura's mwEmbed HTML5 player library: CVE-2026-19913 (arbitrary file read, CVSS 9.1) and CVE-2026-19912 (remote code execution, CVSS 10.0). Researcher Gerjan Wemekamp of AndDone first notified Kaltura on 23 March 2026, resubmitted in April and May, and escalated to CERT/CC and CISA in July 2026 after receiving no vendor response. CERT/CC stated it was unable to reach Kaltura prior to publication. No patch exists as of the disclosure date.
Affected scope
Kaltura mwEmbed player library (also distributed as html5lib), versions v2.45, v2.103, and earlier v2.x releases (Kaltura Server v14.12.0 through West-23.5.0) exposing the mwEmbedLoader.php endpoint. Scope extends beyond individual self-hosted installations to Kaltura's shared multi-tenant CDN infrastructure, meaning all tenants served from those shared hosts are affected. Approximately 630 internet-exposed instances were identified by the researcher via search-engine reconnaissance.
Technical assessment
Both vulnerabilities originate from the same root cause: the mwEmbedLoader.php endpoint accepts a user-controlled ServiceUrl parameter which the KalturaClientBase PHP client fetches without validating the scheme, source, or content, then passes directly to PHP's unserialize() function. For CVE-2026-19913, supplying a file:// URI causes the server to read a local file; the deserialisation failure reflects raw file bytes in the error response, enabling retrieval of sensitive configuration data including plaintext credentials. CVE-2026-19912 chains the same deserialization primitive with an unsanitised uiconf_id parameter appended to a cache directory path, allowing directory traversal that can place malicious code in a web-accessible location and achieve remote code execution as the web-server user. Neither attack requires authentication or a session token.
Recommended defensive actions
- Restrict or disable all external access to the mwEmbedLoader.php endpoint at the web server or network perimeter immediately, as no vendor patch is available
- Enforce a strict allow-list for the ServiceUrl parameter at the application or WAF layer, permitting only known, legitimate Kaltura internal system API URLs
- Audit web server and application logs for anomalous requests to mwEmbedLoader.php containing file:// schemes, non-Kaltura hostnames in ServiceUrl, or directory traversal sequences (../) in uiconf_id parameters
- Rotate any credentials and secrets stored in Kaltura configuration files if the endpoint was previously internet-accessible without access controls
- Subscribe to Kaltura security communications and apply any vendor patch as the highest priority upon release
Uncertainties and evidence gaps
- Kaltura has not publicly responded; whether SaaS-hosted or Kaltura-managed environments receive independent patching is unconfirmed
- The NVD had not published enriched records for either CVE at time of research; CVSS scores are sourced solely from the researcher's writeup and have not been independently verified by NVD
- The ~630-instance exposure estimate derives solely from the researcher's search-engine reconnaissance and has not been independently validated
- It is unknown whether threat actors have privately developed working exploits; the detailed technical writeup provides sufficient information for capable adversaries to reproduce both attack chains without additional independent research
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No active exploitation confirmed as of 25 August 2026; neither CVE appears in the CISA Known Exploited Vulnerabilities catalogue. No vendor patch is available, approximately 630 internet-exposed instances have been identified, and no threat actor activity has been reported.
Investigation began with the THN article as the initial lead, which provided CVE IDs and upstream source URLs. The CERT/CC advisory and the discovering researcher's technical writeup were fetched to establish authoritative confirmed facts. Searches for public exploit code found no standalone PoC beyond the researcher's own validated demonstration, and NVD had not yet published enriched records for either CVE. A third-party secondary source corroborated the core advisory details, satisfying the independent verification requirement.
- What are the confirmed facts about these CVEs and the initial event?Fetched the THN article listed in source materialthehackernews.com ↗
Confirmed CVE IDs, affected component (mwEmbedLoader.php), researcher identity (Gerjan Wemekamp, AndDone), CERT/CC involvement, no patch available, no CISA KEV listing as of 25 August 2026, and lead URLs for the CERT/CC advisory and researcher writeup
why Established the event baseline and surfaced primary source URLs to verify independently
- What does the authoritative CERT/CC advisory confirm?Fetched CERT/CC vulnerability note VU#308749kb.cert.org ↗
Confirmed both CVEs, affected versions (v2.45, v2.103 and earlier v2.x), disclosure timeline (CERT/CC notified 8 July 2026, published 25 August 2026), vendor unreachable status, and recommended mitigations
why CERT/CC advisory is the primary authoritative disclosure record; its existence and content confirm the event was formally coordinated by a recognised body, not merely claimed by a news outlet
- What technical detail and PoC evidence does the original researcher's writeup provide?Fetched the AndDone technical writeupanddone-git.github.io ↗
Confirmed CVSS scores (CVE-2026-19913: 9.1, CVE-2026-19912: 10.0), full disclosure timeline from 23 March 2026, affected version range (Kaltura Server v14.12.0 through West-23.5.0), PoC validation on current Docker image, approximately 630 exposed instances, and no standalone public exploit code released
why The researcher's writeup is the original discovery record; PoC validation on current release code confirms the vulnerability is present in deployed versions and is not merely theoretical or restricted to legacy releases
- Are there enriched NVD records or public exploit code for these CVEs?Fetched NVD detail page for CVE-2026-19912 and checked a community 2026 CVE PoC repository on GitHubgithub.com ↗
NVD returned its homepage rather than a populated CVE record, indicating no enriched entry published yet. The community PoC repository contained no entries for CVE-2026-19912 or CVE-2026-19913.
why Absence of public standalone exploit code slightly reduces immediate opportunistic exploitation risk; NVD non-publication is consistent with the recency of these CVEs and ongoing backlog issues
- Is there an independent corroborating source from a second domain confirming the advisory details?Fetched Vista Net Inc. secondary coverage of VU#308749vistanetinc.com ↗
Page confirmed both CVEs, affected component, zero-authentication attack preconditions, multi-tenant CDN scope, and recommended mitigations — fully consistent with CERT/CC and AndDone with no contradictions
why Provides a second independent domain confirming the core facts; consistency across sources with no contradictions raises confidence in the accuracy of the disclosed details
Research coverage
All 67 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (1 primary, 1 corroborating, 0 contextual and 0 PoC/exploit references). 57 completed sources contained no matched information for this story.
Complete source-by-source audit 67 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| The Hacker Newsnews | ok12 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| NVDcve | ok900 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| AlienVault OTXdark_web | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| BleepingComputernews | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1682 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5333 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok687 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1012 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| FIRST EPSSepss | ok | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok18 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok13 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1591 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 5 opened outside the registered collection
Technical references1
Repository captured from the source article as technical context; not validated as PoC or exploit code.
PoC & exploit code1
Researcher Gerjan Wemekamp's primary technical writeup; includes PoC validation for both file read and RCE chains on current Kaltura release code, confirmed CVSS scores, and full disclosure timeline
Vendor & gov advisories1
Primary authoritative disclosure; confirms no patch available, vendor unreachable, and recommends endpoint access restriction and ServiceUrl allow-listing
Analysis & research2
Mainstream threat-intelligence reporting drawing on CERT/CC advisory and researcher writeup; confirms scope, CISA KEV absence, and multi-tenant CDN impact
Independent secondary corroboration reproducing CERT/CC advisory details from a separate source domain