Kaltura mwEmbed/html5lib video player: unauthenticated RCE and arbitrary file read via an undocumented ServiceUrl parameter, no vendor response, no patch, 630+ exposed instances found by the discoverer

Kaltura mwEmbed/html5lib video player: unauthenticated RCE and arbitrary file read via an undocumented ServiceUrl parameter; patched for legacy Player V2 after months of no vendor response, 630+ exposed instances found by the discoverer

Two unauthenticated vulnerabilities exist in Kaltura's mwEmbed/html5lib video-player library, reachable at the mwEmbedLoader.php endpoint with no session, token or user interaction. The root cause is an undocumented ServiceUrl request parameter that lets the caller control the URL the server fetches data from: KalturaClientBase.php's doQueue() function concatenates it unchecked into a request URL with no origin or scheme validation, then feeds the fetched response through PHP's unserialize() with no signature check, origin check, or class allow-list.

CVE-2026-19913 (CVSS 9.1): supplying a file:// scheme in ServiceUrl makes the application fetch and attempt to deserialize an internal file's contents; failed-deserialization error messages reflect the raw file bytes back to the client, yielding arbitrary local file read. CVE-2026-19912 (CVSS 10.0): the uiconf_id request parameter is concatenated unsanitized into the on-disk cache-file destination path, "kInfraFileSystemCacheWrapper::getFilePath(), in infra/cache/, builds the on-disk destination by concatenating the cache base directory with a path derived from the uiconf_id request parameter, with no sanitisation" (AndDone (Gerjan Wemekamp), 2026-08-26), so path-traversal sequences in uiconf_id escape the cache directory; combined with the unchecked unserialize() above (PHP object injection), this reaches unauthenticated remote code execution when the default file-based cache backend is in use and PHP execution is not blocked in the cache directory.

The discoverer fully demonstrated the file-read path against a production bug-bounty target and the current codebase, and validated the full RCE chain end-to-end against a 2019-era Kaltura Server Docker image (14.12.0); the vulnerable code is confirmed unchanged in the current West-23.5.0 release, though no current-release container was available to re-run the full RCE demonstration against. The discoverer found 630+ indexed, internet-facing Kaltura instances via a search query. Disclosure attempts spanned personal email (23 March 2026), corporate email (13 April), LinkedIn escalation (23 May) and national CERT involvement (2 July); CERT/CC's advisory recorded at that point that it had been unable to reach the vendor to coordinate, a statement its 2026-08-28 revision replaced with the patch announcement (CERT/CC, VU#308749), and no vendor response or patch existed when this was first reported. Because Kaltura is frequently deployed as shared, multi-tenant CDN/hosting infrastructure, a single exposed mwEmbedLoader.php can put every tenant served by that shared host at risk. Kaltura's video platform is widely used by universities and research institutions for lecture capture and media hosting, a use case common across Swiss and EU academic institutions.

Triage: any inbound request to mwEmbedLoader.php carrying a ServiceUrl parameter with a non-http(s) scheme (file:// in particular), or a uiconf_id value containing path-traversal sequences (../, encoded variants), has no legitimate explanation, normal player-loading traffic never sets ServiceUrl to a local-file scheme or supplies a traversal-shaped uiconf_id. Until a deployment is on the patched legacy player or on Player V7, WAF-level pattern blocking on those two parameter shapes is the mitigation short of taking the endpoint offline.