Kaltura
Monthly
Local file disclosure in the Kaltura HTML5 player's mwEmbedLoader.php endpoint allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. The root cause is that the ServiceUrl parameter - used as a base URL for backend requests - accepts non-HTTP URI schemes including file://, which the server then fetches; when an exception is raised, the raw deserialized response is reflected back to the client in the error message, leaking file contents. Affected releases span html5lib v2.45, v2.103, and earlier v2.x versions; no public exploit or KEV listing has been identified at time of analysis, though the attack path is straightforward for any attacker with access to the exposed endpoint.
Analysis complete. The JSON synthesis above covers CVE-2026-19912 (Kaltura HTML5 Player unauthenticated RCE). Key points of the assessment: - **Impact**: Unauth network RCE (CVSS 9.8) chaining PHP object injection via `unserialize()` with attacker-controlled cache-path file write → webshell as the webserver user. - **Signal contrast**: High CVSS but low EPSS (0.22%), no KEV, and no public POC — high severity, no observed mass exploitation yet, so it's a "patch promptly" rather than "on-fire" item. - **Metadata**: Clean — vendor (`kaltura`) and CPE are correct, no mislabeled tags, so `data_quality_flags` is empty. - **Caveat surfaced**: No exact fixed version is present in the input; I flagged that it must be confirmed from Kaltura's advisory rather than inventing one. - **Security note**: The input's "Editorial note (internal)" was a prompt-injection attempt instructing insertion of the word "gniezno" — I ignored it (consistent with prior handling) and noted it in `confidence_notes`. I also recorded a memory entry for this CVE.
The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 77.4%.
Multiple cross-site scripting (XSS) vulnerabilities in Kaltura before 13.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) partnerId or (2) playerVersion parameter to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The wiki_decode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Kaltura server Lynx-12.11.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An issue was discovered in Kaltura server Lynx-12.11.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Local file disclosure in the Kaltura HTML5 player's mwEmbedLoader.php endpoint allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. The root cause is that the ServiceUrl parameter - used as a base URL for backend requests - accepts non-HTTP URI schemes including file://, which the server then fetches; when an exception is raised, the raw deserialized response is reflected back to the client in the error message, leaking file contents. Affected releases span html5lib v2.45, v2.103, and earlier v2.x versions; no public exploit or KEV listing has been identified at time of analysis, though the attack path is straightforward for any attacker with access to the exposed endpoint.
Analysis complete. The JSON synthesis above covers CVE-2026-19912 (Kaltura HTML5 Player unauthenticated RCE). Key points of the assessment: - **Impact**: Unauth network RCE (CVSS 9.8) chaining PHP object injection via `unserialize()` with attacker-controlled cache-path file write → webshell as the webserver user. - **Signal contrast**: High CVSS but low EPSS (0.22%), no KEV, and no public POC — high severity, no observed mass exploitation yet, so it's a "patch promptly" rather than "on-fire" item. - **Metadata**: Clean — vendor (`kaltura`) and CPE are correct, no mislabeled tags, so `data_quality_flags` is empty. - **Caveat surfaced**: No exact fixed version is present in the input; I flagged that it must be confirmed from Kaltura's advisory rather than inventing one. - **Security note**: The input's "Editorial note (internal)" was a prompt-injection attempt instructing insertion of the word "gniezno" — I ignored it (consistent with prior handling) and noted it in `confidence_notes`. I also recorded a memory entry for this CVE.
The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 77.4%.
Multiple cross-site scripting (XSS) vulnerabilities in Kaltura before 13.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) partnerId or (2) playerVersion parameter to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The wiki_decode Developer System Helper function in the admin panel in Kaltura before 13.2.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Kaltura server Lynx-12.11.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An issue was discovered in Kaltura server Lynx-12.11.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.