Kaltura Unpatched: RCE and File Read in mwEmbed, No Fix for Five…

CERT/CC disclosed two critical unpatched vulnerabilities in Kaltura's mwEmbed library enabling remote code execution and arbitrary file read. The vendor has been unreachable since March 2026.

The CERT Coordination Center publicly disclosed two critical flaws in Kaltura's HTML5 mwEmbed library on August 25, 2026, allowing unauthenticated remote code execution and arbitrary file read. No official patch is available. Kaltura, repeatedly contacted by researcher Gerjan Wemekamp and CERT/CC since March 2026, has not responded to the reports, leaving a documented and reproducible exploit chain open on over 600 exposed instances.

Key Takeaways

CVE-2026-19912 (RCE) and CVE-2026-19913 (arbitrary file read) stem from unsafe deserialization in mwEmbedLoader.php via PHP unserialize() without validation of source, scheme, or content.
The attack requires no authentication or Kaltura tokens: only network access to the endpoint, which is also exposed on the vendor's shared, multi-tenant CDN infrastructure.
The vulnerable code in KalturaClientBase.php is byte-identical across 21 releases from 2015 through August 13, 2026, with the unserialize() call present since 2014.
No active exploitation has been reported at the time of disclosure; neither CVE appears in the CISA Known Exploited Vulnerabilities catalog.

The Attack Chain: From File Read to Web Shell in Two Steps

The technical core is an unsafe deserialization in KalturaClientBase.php, invoked by mwEmbedLoader.php. The PHP client fetches an external URL and passes it directly to unserialize() without verifying origin, scheme, or content.

The first link, CVE-2026-19913, exploits the ServiceUrl parameter. According to the NVD record, the endpoint accepts non-HTTP schemes such as file://. When the client fetches a local file, deserialization fails and the raw bytes are reflected in the error message, allowing arbitrary reading of sensitive files like local.ini containing database credentials.

The second link, CVE-2026-19912, acts on the uiconf_id parameter. The value is concatenated to the cache directory path without sanitization. An attacker can inject directory traversal sequences such as ../ to redirect the file write outside the cache, into a web-accessible directory. At that point, ServiceUrl points to a malicious serialized object written as a web shell and executed by the server.

The combination of the two steps enables RCE as the web server user, with immediate impact on self-hosted instances and tenants of Kaltura's shared CDN.

"Because the affected endpoint is also exposed on Kaltura's shared, multi-tenant CDN infrastructure, these vulnerabilities affect not only individual customer installations, but also every tenant served by these shared hosts" — CERT/CC VU#308749

The Timeline of a Ghosting: Five Months of Coordinated Disclosure Into the Void

Coordinated disclosure began on March 23, 2026, when Gerjan Wemekamp of AndDone sent the first report to Kaltura. Per the timeline documented by The Hacker News, the researcher re-sent the report on April 13, contacted the CISO via LinkedIn on May 23, and escalated through a national CERT on July 2. CERT/CC notified Kaltura on July 8. No response arrived. On August 25, 2026, with the vulnerabilities still unpatched, CERT/CC proceeded with public disclosure.

The systemic issue is clear: coordinated disclosure works only if both parties are reachable. Kaltura's security.txt confirms a HackerOne channel, but the dossier does not clarify whether the researcher used that formal route or whether initial reports reached the correct team. What is documented is the absence of response on the channels actually pursued.

600 Exposed Instances and Twelve-Year-Old Code

The persistence of the flaw is striking. The Hacker News verified that the vulnerable code is byte-identical across 21 reference releases, from Jupiter-10.9.0 (April 27, 2015) to West-23.5.0 (August 13, 2026). The unserialize() call dates to March 10, 2014. Kaltura removed other unsafe calls in 2017 with release 13.2.0, but not the one in KalturaClientBase.php.

Regarding exposure, Rescana and Kobaran converge on over 600 internet-exposed instances identified via search engine queries. These include self-hosted installations and those on Kaltura's multi-tenant CDN infrastructure. The exact counting methodology and geographic distribution of instances are not clear, however.

Wemekamp assigned CVSS 10.0 to CVE-2026-19912 and 9.1 to CVE-2026-19913; these are reporter-assigned, not official NVD scores. For CVE-2026-19913, the National Vulnerability Database publishes a CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N score of 7.5 HIGH. For CVE-2026-19912, NVD has not yet published an official score.

What to Do Now

Mitigations documented by primary sources are partial and do not replace a patch. Priority actions include:

Verify whether the organization exposes mwEmbedLoader.php on self-hosted Kaltura installations or shared CDNs, by scanning public endpoints.
Apply access restrictions to the mwEmbedLoader.php endpoint where technically feasible, limiting the attack surface.
Evaluate alternative caching configurations: per the researcher, a memcache-only configuration can suppress the file-write-based RCE path, but does not eliminate the underlying deserialization vulnerability.
Monitor logs for suspicious requests to mwEmbedLoader.php with anomalous ServiceUrl or uiconf_id parameters, including traversal sequences and non-HTTP schemes.

Why the Kaltura Case Questions the Software Supply Chain

The incident is not merely technical. Kaltura is an enterprise video platform adopted by universities, broadcasters, and large organizations. The discovery of such an elementary flaw — unserialize() without validation — in a core component used for more than a decade raises questions about the vendor's security engineering maturity.

The coordinated disclosure failure adds a contractual dimension. Organizations paying for enterprise licenses expect a vulnerability response channel. When that channel yields no response for five months, the risk shifts entirely to the buyer, without effective tools to mitigate it. The dossier does not establish that Kaltura deliberately ignored the reports; what is established is that the channels pursued generated no engagement.

The researcher clarified the limits of their testing: the full web shell drop was demonstrated on the 2019 Kaltura Server Docker image; on the current release, they verified that both halves of the chain are present and the deserialization portion remains executable as described. This means the proof-of-concept is reproducible, even if the specific target configuration modulates the impact.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter