Kaltura makes the video platform a great many universities and enterprises embed in their sites. Two vulnerabilities in its mwEmbed player library were published on 25 August 2026. Neither is patched.
- CVE-2026-19913 — arbitrary file read, scored 9.1
- CVE-2026-19912 — remote code execution, scored 10.0
Both scores are the researcher's own. CERT/CC published no official ratings.
The bug
The endpoint mwEmbedLoader.php accepts a ServiceUrl parameter. The KalturaClientBase PHP client fetches whatever that URL returns and passes it to PHP's unserialize() without validating the source, the scheme, or the content.
Supply a file:// path and it reads local files. Researcher Gerjan Wemekamp used it to retrieve the platform's own configuration file, which contained plaintext database connection strings, admin and console passwords, and internal host references.
The code execution half uses the same deserialization to process a malicious serialized object, combined with a second flaw: the uiconf_id parameter is appended to the cache folder path without sanitisation when the application writes to disk. Traversal sequences redirect those writes into web-accessible directories, where the file can then be requested and executed.
Passing attacker-influenced data to unserialize is one of the oldest documented mistakes in PHP. It is in every guide.
Eleven years, byte for byte
This is the finding that makes the piece.
Wemekamp traced the vulnerable unserialize() call in KalturaClientBase.php and found it byte-identical across 21 release references — from Jupiter-10.9.0, committed on 27 April 2015, to West-23.5.0, committed on 13 August 2026.
Twenty-one releases. Eleven years. Not a regression, not a refactor that reintroduced something, not a subtle interaction between two components. The same line, unchanged, through a decade of releases that presumably included security reviews, audits and customer questionnaires.
It is a useful counterweight to the report finding AI-written code carries a vulnerability in roughly 44% of generation tasks. Humans wrote this one, once, and then nobody looked at it again for eleven years.
Five months of trying to tell them
The disclosure timeline is the second story:
| Date | Step |
|---|---|
| 23 March 2026 | Reported to the vendor |
| 13 April 2026 | Resent from a corporate address |
| 23 May 2026 | Escalated via LinkedIn to the vendor's CISO |
| 2 July 2026 | Escalated to a national CERT |
| 8 July 2026 | Formal CERT/CC notification |
| 25 August 2026 | Published |
CERT/CC's own statement is that it was unable to reach Kaltura to coordinate. The vendor's status for both CVEs is recorded as unknown, with no statement received.
Five months, five escalation routes including a national CERT and CERT/CC, and nobody answered. This is the second time in three days we have written that sentence about a different company — a Calix gateway exposing its UPnP control endpoint to the internet went the same way, reported on 7 June, escalated to CERT/CC, still unpatched.
Coordinated disclosure is not a courtesy the researcher owes the vendor. It is a process that requires two parties, and it is visibly failing at the second one.
The multi-tenant part
The affected endpoint is also exposed on Kaltura's shared, multi-tenant CDN infrastructure. So this is not only a problem for organisations running their own installation — it reaches every tenant served by those shared hosts.
An organisation that has never installed anything, and simply embeds Kaltura-hosted video, has no server to patch and no configuration to change.
What the researcher will not claim
Worth quoting, because it is the right way to publish.
Wemekamp states that the end-to-end web shell drop was demonstrated on a 2019 Kaltura Server docker image. What he verified on the current release is that both halves of the chain are present, and that the deserialization half still executes as described.
So: the full chain is confirmed on an old build, and the components are confirmed on the current one. He does not claim more than that, and neither do we.
What to do
There is no patch, so all of this is mitigation:
- Block or remove the endpoint at your WAF or CDN.
- Allow-list ServiceUrl to legitimate backend APIs only.
- Reject uiconf_id values containing traversal sequences.
- Deny PHP execution in cache directories.
- Restrict outbound network access from application servers — the file read depends on the client fetching a URL you supply.
- Rotate everything in the configuration file. If the file read works against you, those credentials are already exposed, and rotating after a patch arrives is too late.
What is not established
- Whether it is being exploited. None reported, and neither CVE is in CISA's KEV catalog.
- How many installations and tenants are affected. No figure.
- Whether Kaltura is working on a fix. No statement has been received by anyone.
- Whether the full chain works unmodified on current releases. The researcher explicitly does not claim it does.
