Security readout for executives and security teams
Plain-English summary
A publicly reachable Kaltura HTML5 player endpoint may let an unauthenticated attacker place files in web-accessible locations and run code with the webserver account. Successful compromise could expose or alter data and disrupt service. The supplied sources do not identify a confirmed patched version.
Executive priority
Treat as an immediate remediation and investigation priority where the endpoint is internet-accessible. Assign owners to inventory deployments, reduce exposure, obtain confirmed vendor guidance, and examine affected hosts. Systems containing sensitive data or supporting critical services warrant accelerated containment because successful exploitation could provide full application-level compromise.
Technical view
mwEmbedLoader.php accepts an attacker-controlled ServiceUrl, deserializes its response with unserialize(), and constructs a cache path using an insufficiently validated uiconf_id. This combination permits arbitrary file placement and potential remote code execution. The supplied description identifies html5lib 2.45, 2.103 and earlier, plus other vulnerable v2.x deployments exposing the endpoint.
Likely exposure
Highest risk applies to internet-accessible Kaltura mwEmbed/html5lib v2.x deployments exposing mwEmbedLoader.php. Actual exposure depends on deployed version, endpoint reachability, and configuration. The supplied affected-version data is inconsistent, so organizations should inventory all v2.x instances rather than rely solely on a narrow version range.
Exploitation context
The vulnerability is remotely reachable, requires no authentication or user interaction, and has low stated attack complexity. CVSS 3.1 rates it 9.8. The supplied bundle says it is not in KEV and provides no evidence of active exploitation; absence from KEV does not prove exploitation is not occurring.
Researcher notes
The described chain combines unsafe deserialization with attacker-influenced filesystem path construction. CWE-20 and CWE-22 are supplied. Public evidence in the bundle does not establish exploit activity, a definitive complete affected-version boundary, or a fixed release. Validation should remain non-destructive and focus on endpoint exposure, version provenance, logs, filesystem anomalies, and vendor-confirmed remediation.
Mitigation direction
- Restrict external access to mwEmbedLoader.php until vendor remediation is confirmed.
- Inventory Kaltura mwEmbed and html5lib v2.x deployments, including embedded or legacy copies.
- Check Kaltura and CERT/CC guidance for confirmed fixed versions or supported mitigations.
- Prioritize replacement or isolation of unsupported player versions.
- Preserve relevant web, filesystem, and process logs before remediation.
Validation and detection
- Confirm whether mwEmbedLoader.php is deployed and reachable without authentication.
- Identify exact html5lib and mwEmbed versions across production and staging systems.
- Review web logs for unusual ServiceUrl or uiconf_id values.
- Inspect web-accessible cache locations for unexpected or recently created executable files.
- Review webserver-account processes and file changes for signs of compromise.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-20: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-19912 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://kb.cert.org/vuls/id/308749CVE reference, certcc
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE mapping pending import
This CVE carries a CWE mapping that will resolve to a full Glexia CWE intelligence page after the official CWE import is complete.
Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.