Kaltura HTML5 Player RCE via Unsafe Deserialization

The Kaltura HTML5 player (mwEmbed / html5lib) is affected by an unauthenticated remote code execution vulnerability.

Unsafe data deserialization and unsanitized filesystem path construction allow an attacker to write arbitrary files into web-accessible locations and achieve code execution as the webserver user.

This is due to mwEmbedLoader.php accepting a user-controlled ServiceUrl, whose response is passed to unserialize(), and the resulting object’s fields are written to a cache path derived from attacker-supplied uiconf_id without proper path validation.

Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.