CVE-2026-19912 CVE-2026-19912
Unauthenticated attackers can achieve remote code execution via unsafe deserialization and path traversal in the Kaltura HTML5 player.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19912?
CVE-2026-19912 is a critical unsafe deserialization vulnerability in Kaltura HTML5 Video Player, html5 library, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize(), and the resulting object’s fields are written to a cache path derived from attacker‑supplied uiconf_id without proper path validation. An attacker can write arbitrary files into web‑accessible locations and achieve code execution as the webserver user. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.
Which versions are affected by CVE-2026-19912?
How do I fix CVE-2026-19912?
No fix has been published for CVE-2026-19912 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-19912 being exploited?
There is no known exploitation of CVE-2026-19912 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-537c-gp6x-jr7q.