Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

Unpatched Kaltura mwEmbed Flaws Could Let Remote Attackers Read Files and Run Code

Notícia de segurança recolhida automaticamente.

The CERT Coordination Center (CERT/CC) has disclosed two unpatched vulnerabilities in Kaltura's HTML5 video player library that allow a remote, unauthenticated attacker to read arbitrary files from a server and execute code on it.

The flaws, tracked as CVE-2026-19913 and CVE-2026-19912, both stem from the same unsafe deserialization in the mwEmbedLoader.php endpoint of the mwEmbed player

Fonte original: Ler artigo completo aqui