The severity figures in circulation belong to the finder. Gerjan Wemekamp of AndDone, credited with both reports, scored CVE-2026-19912 at 10.0 and CVE-2026-19913 at 9.1 and marked them reporter-assigned in his writeup; CERT/CC published no score of its own, and there was no NVD record for either identifier as of 25 August 2026 [14]. Triage tooling that keys off a published severity will therefore return nothing for either bug [16].
The mechanism is one sink reached two ways. `mwEmbedLoader.php` takes the `ServiceUrl` parameter as the target for backend API requests, and `KalturaClientBase` hands whatever comes back to PHP's `unserialize()` without checking the source, the scheme, or the content [7]. Point it at a `file://` path and the server fetches a local file instead of an API response; deserialization fails, and the raw bytes of the file are reflected to the requester inside the error message [8]. Wemekamp used that to read `/opt/kaltura/app/configurations/local.ini`, which holds plaintext database connection strings, admin and console passwords, and internal host references [9].
The second bug reuses the same deserialization and adds a write. `uiconf_id` is appended to the cache folder path without sanitisation, so traversal sequences steer the deserialized payload out of the cache directory and into a web-accessible one, where requesting it directly runs it as the web-server user [10]. Wemekamp notes the file-drop step depends on the file-based cache backend, which is Kaltura's default, and that a memcache-only configuration may suppress that particular path without making the deployment safe [11].
That asymmetry matters for anyone building the compensating controls. Restricting outbound access from the application server is on the advised list precisely because the code execution chain needs an outbound fetch to pull the payload [12]. The file read needs no egress at all, because the fetch target is the local filesystem [18]. Egress policy buys you the worse half of the problem and none of the credential disclosure.
Inventory is the other soft spot. CERT/CC lists html5lib v2.45, v2.103 and earlier, and other v2.x releases that expose the vulnerable endpoint [13]. The trailing clause means a version match will not settle whether a host is affected; the endpoint's presence will. And with six advised actions and zero fixed versions [17], the operator running html5lib is now the de facto maintainer of a component whose upstream did not answer.
One caveat on sourcing: the account here rests on a single published report of the CERT/CC note and the researcher's writeup, with no vendor comment in it [4].
