Affected Systems
Kaltura mwEmbed (html5lib) v2.45, v2.103, and all earlier v2.x releases exposing mwEmbedLoader.php. Affects customer installations and Kaltura's shared multi-tenant CDN infrastructure. Vulnerable code present since at least March 2014 through West-23.5.0 (August 2026).
Exploitation Status
No active exploitation reported as of August 25, 2026. Not listed in CISA KEV. Proof-of-concept demonstrated by researcher Gerjan Wemekamp. Full RCE chain verified on 2019 docker image; both vulnerability components confirmed present in current release.
Business Impact
Remote unauthenticated attackers can read arbitrary server files including /opt/kaltura/app/configurations/local.ini containing database credentials, admin passwords, partner secrets, and API keys (CVE-2026-19913, CVSS 9.1). Attackers can also achieve remote code execution as the web-server user by combining unsafe deserialization with path traversal (CVE-2026-19912, CVSS 10.0). No patch available. CERT/CC unable to reach vendor for coordination. Multi-tenant CDN exposure amplifies risk across all Kaltura shared hosting customers.
Urgency
🟠Within 24 hours
Recommended Actions
- Block access to mwEmbedLoader.php at WAF, reverse proxy, or CDN level if legacy mwEmbed players are not required
- Implement strict allow-list for ServiceUrl parameter permitting only your deployment's API host; reject file://, data://, and all non-HTTP(S) schemes
- Reject uiconf_id values containing directory traversal sequences (../, absolute paths, or directory separators) at application or WAF layer
- Disable PHP execution in Kaltura cache directories via web server configuration (e.g., Apache .htaccess or nginx location block)
- Rotate all credentials in /opt/kaltura/app/configurations/local.ini including database passwords, admin/console credentials, partner secrets, and API keys
- Restrict outbound network access from Kaltura application servers to prevent payload fetch during exploitation attempts