Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code
- ID
- 18147
- Status
- summarized
- Published
- 26 Aug 2026, 7:55 PM
- Fetched
- 26 Aug 2026, 9:35 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/unpatched-kaltura-mwembed-flaws-could.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.5
- Created
- 26 Aug 2026, 9:37 PM
- Tags
- Audience
- developerssaas_founders
What happened
CERT/CC disclosed two unpatched Kaltura mwEmbed vulnerabilities (CVE-2026-19913, CVE-2026-19912) enabling unauthenticated remote file read and code execution via unsafe PHP deserialization in mwEmbedLoader.php. No patch exists; CERT/CC could not reach Kaltura to coordinate. The flaws affect both customer installations and Kaltura's shared multi-tenant CDN hosts.
Why it matters
If your org runs Kaltura for video management—common in education and enterprise—restrict external access to mwEmbedLoader.php now and enforce a strict allow-list on the ServiceUrl parameter, since there is no vendor patch and the endpoint requires no authentication. For everyone else, this is a cautionary case of PHP unserialize() on unvalidated external input worth remembering in your own code.
Discussion angle
The broader lesson: unsafe deserialization of data fetched from a user-controlled URL is still a live RCE vector in 2026—worth checking your own PHP or polyglot codebases for similar patterns even if you don't use Kaltura.