CVE-2026-19912: CWE-20 Improper Input Validation in Kaltura Kaltura HTML5 Video Player, html5 library

The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability due to unsafe data deserialization and unsanitized filesystem path construction. Specifically, mwEmbedLoader.php accepts a user-controlled ServiceUrl, whose response is passed to PHP's unserialize() function. The resulting object's fields are used to construct a cache path derived from an attacker-supplied uiconf_id without proper path validation. This allows an attacker to write arbitrary files into web-accessible locations and achieve code execution with the privileges of the webserver user. Affected versions include html5lib v2.45, v2.103, and other v2.x releases exposing the vulnerable endpoint. There is no vendor advisory indicating a patch or fix at this time.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the server running the Kaltura HTML5 Video Player by writing malicious files to web-accessible locations. This can lead to full compromise of the webserver process, resulting in confidentiality, integrity, and availability impacts. The CVSS score of 9.8 reflects the critical severity and ease of exploitation without authentication.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/308749 for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint if possible and monitor for suspicious activity related to file writes or unserialize() usage. Avoid exposing the vulnerable service publicly if feasible.