Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-08-26 11:55 UTC
Importiert: 2026-09-02 09:07 UTC
CVSS: 7.5
Quelle-ID: thn_global
uid_hash: 9442de89f4db8b1286f7adf2820d67d8cda2f7dc4cbc6517d93e485d36491042

The Hacker News

Inhalt

The CERT Coordination Center (CERT/CC) has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it.

The flaws, tracked as CVE-2026-19913 and CVE-2026-19912, both stem from the same unsafe deserialization in the mwEmbedLoader.php endpoint of the mwEmbed player

Verknuepfte CVEs

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-19912	HIGH	7.5	CRITICAL	9.8			2026-08-25
CVE-2026-19913	HIGH	7.5	HIGH	7.5			2026-08-25

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
The Hacker News	thn_global	security_news		-	de	https://feeds.feedburner.com/TheHackersNews

Zurueck zur Eintrags-Liste