Critical Vulnerabilities in Kaltura HTML5 Player Expose Organizations to Attacks

Rescana

Critical Vulnerabilities in Kaltura HTML5 Player Expose Organizations to Attacks

First seen 26 Aug 2026, 15:18 UTC • •72.8

Article Content

1 / 7

Browse articles

ThreatCluster •August 27, 2026 at 15:04 UTC

•Two critical vulnerabilities in Kaltura HTML5 Player allow remote code execution and file read.
•Over 600 instances are exposed, with no patches currently available.
•Attackers can exploit these vulnerabilities without authentication, posing a significant risk.

Two critical vulnerabilities, CVE-2026-19912 and CVE-2026-19913, have been discovered in the Kaltura HTML5 Player Library (mwEmbed/html5lib). These flaws allow unauthenticated remote attackers to execute arbitrary code and read sensitive files on affected servers. The vulnerabilities stem from unsafe deserialization and improper handling of user-controlled parameters in the mwEmbedLoader.php endpoint. Over 600 internet-facing instances are at risk, including those hosted on Kaltura's multi-tenant CDN infrastructure. As of now, no official patches are available, and organizations are advised to restrict access to the vulnerable endpoint. The vulnerabilities have received CVSS scores in the critical range (9.1-10.0), indicating a severe risk to affected systems. Exploitation methods are straightforward, with proof-of-concept code available for both vulnerabilities. The affected versions include html5lib v2.45, v2.103, and earlier releases.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 45d ago How this analysis works

Timeline

2026-08-25

CVE-2026-19912 and CVE-2026-19913 published

Kaltura HTML5 Player vulnerabilities disclosed, allowing remote code execution and file read.

2026-08-26

Critical vulnerabilities reported in Kaltura

Rescana reports on two critical vulnerabilities affecting Kaltura's HTML5 Player, with significant implications for organizations.

2026-08-26

NVD CVE records published

NVD includes CVE-2026-19913 in its database, confirming the vulnerability details.

2026-08-26

Rapid7 CVE-2026-19912 report

Rapid7 provides additional details on the remote code execution vulnerability in Kaltura's HTML5 player.

More articles in this cluster (6)

Threat Graph

17 entities, 33 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (7)

Data Breach
Zero-day Exploit
T1005 - Data From Local System
T1041 - Exfiltration Over C2 Channel
T1059 - Command and Scripting Interpreter
T1190 - Exploit Public-Facing Application
T1505.003 - Web Shell

Vulnerability (2)

CVE-2026-19912
CVE-2026-19913

Weakness (4)

CWE-200 - Exposure of Sensitive Information
CWE-22 - Path Traversal
CWE-287 - Improper Authentication
CWE-502 - Deserialization Of Untrusted Data

Affected Platform (3)

Html5lib
Kaltura
PHP

Tool (1)

Docker

Relationships

Docker exploits CVE-2026-19912
Docker exploits CVE-2026-19913
CVE-2026-19912 targets Html5lib
CVE-2026-19912 targets Kaltura
CVE-2026-19912 targets PHP
CVE-2026-19913 targets Html5lib
CVE-2026-19913 targets Kaltura
CVE-2026-19913 targets PHP
Data Breach targets Html5lib
Data Breach targets Kaltura
Data Breach targets PHP
Zero-day Exploit targets Html5lib
Zero-day Exploit targets Kaltura
Zero-day Exploit targets PHP
T1005 - Data From Local System targets Html5lib
T1005 - Data From Local System targets Kaltura
T1005 - Data From Local System targets PHP
T1041 - Exfiltration Over C2 Channel targets Html5lib
T1041 - Exfiltration Over C2 Channel targets Kaltura
T1041 - Exfiltration Over C2 Channel targets PHP
T1059 - Command and Scripting Interpreter targets Html5lib
T1059 - Command and Scripting Interpreter targets Kaltura
T1059 - Command and Scripting Interpreter targets PHP
T1190 - Exploit Public-Facing Application targets Html5lib
T1190 - Exploit Public-Facing Application targets Kaltura
T1190 - Exploit Public-Facing Application targets PHP
T1505.003 - Web Shell targets Html5lib
T1505.003 - Web Shell targets Kaltura
T1505.003 - Web Shell targets PHP
CVE-2026-19912 related to CWE-200 - Exposure of Sensitive Information
CVE-2026-19912 related to CWE-22 - Path Traversal
CVE-2026-19912 related to CWE-287 - Improper Authentication
CVE-2026-19912 related to CWE-502 - Deserialization Of Untrusted Data

Following this threat?

Track CVE-2026-19912 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…