Rapid7 CVE-2026-19912

www.rapid7.com • August 26, 2026

The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize(), and the resulting object’s fields are written to a cache path derived from attacker‑supplied uiconf_id without proper path validation. An attacker can write arbitrary files into web‑accessible locations and achieve code execution as the webserver user. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Kaltura HTML5 Player Expose Organizations to Attacks Two critical vulnerabilities, CVE-2026-19912 and CVE-2026-19913, have been discovered in the Kaltura HTML5 Player Library (mwEmbed/html5lib). These flaws allow unauthenticated remote attackers to execute arbitrary code and read sensitive files on affected servers. The vulnerabilities stem from unsafe deserialization and improper handling of user-controlled parameters in the mwEmbedLoader.php endpoint. Over 600 internet-facing instances are at risk, including those hosted on Kaltura's multi-tenant CDN infrastructure. As of now, no official patches are available, and organizations are advised to restrict access to the vulnerable endpoint. The vulnerabilities have received CVSS scores in the critical range (9.1-10.0), indicating a severe risk to affected systems. Exploitation methods are straightforward, with proof-of-concept code available for both vulnerabilities. The affected versions include html5lib v2.45, v2.103, and earlier releases. 2 sources 73

Extracted Entities

Rapid7 CVE-2026-19912

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (3)