Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code
The CERT Coordination Center (CERT/CC) has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. The flaws, tracked as CVE-2026-19913 and CVE-2026-19912, both stem from the same unsafe deserialization in the mwEmbedLoader.php endpoint of the mwEmbed player
Contenu original affiche; la traduction localisee n'est pas encore disponible.
Ce qui s'est passé
The CERT Coordination Center (CERT/CC) has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it. The flaws, tracked as CVE-2026-19913 and CVE-2026-19912, both stem from the same unsafe deserialization in the mwEmbedLoader.php endpoint of the mwEmbed player
Pourquoi c'est important
The development may change operating conditions or market expectations around Security. Further confirmation and measurable outcomes matter.
Entités concernées
Voir les preuves
1 articles · 1 publication d'origine · 1 independantes
- The Hacker NewsSource primaire · Confirme · EN · 100%Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code ↗
Affirmations
- Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code Signalé
Divergences
Aucune divergence importante détectée dans les preuves disponibles.
Chronologie
- Premier signalement
Mouvement de marché suivant l'événement
La réaction du marché n'est pas encore disponible pour cet actif et cette fenêtre.