VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Kaltura's HTML5 Player Library exposes the mwEmbedLoader.php endpoint which accepts a user-controlled ServiceUrl parameter. The KalturaClientBase PHP client library fetches data from this URL and unserializes it without validation, leading to CVE-2026-19913 where an attacker can read arbitrary files by supplying a file:// URL and triggering error messages that leak file contents. CVE-2026-19912 arises from unsanitized uiconf_id parameter used in file path construction, allowing directory traversal to write malicious serialized PHP objects to web-accessible directories, enabling remote code execution. These vulnerabilities require no authentication and affect all deployments exposing the vulnerable endpoint, including Kaltura's shared multi-tenant CDN infrastructure. The vulnerabilities are limited to legacy Player V2 versions; Player V7 is not affected.

Remote, unauthenticated attackers can read arbitrary local files, potentially exposing sensitive data such as database credentials and API keys (CVE-2026-19913). They can also achieve remote code execution as the web-server user (CVE-2026-19912), allowing modification or exfiltration of platform data, deployment of persistence tools, and further compromise. The vulnerabilities affect not only individual customer installations but also tenants on Kaltura's shared CDN infrastructure, increasing the scope of impact.

Kaltura has released patches for all affected legacy Player V2 versions. Users should update to these patched versions or migrate to the supported Kaltura Player V7 platform. Until patches are applied, it is recommended to restrict or disable external access to the mwEmbedLoader.php endpoint and enforce a strict allow-list for the ServiceUrl parameter to permit only legitimate backend API URLs. These mitigations reduce risk by limiting exposure to the vulnerable functionality.