The Kaltura HTML5 Player Library, specifically versions html5lib v2.45, v2.103 and earlier, contains two critical vulnerabilities. Both stem from an insecure deserialization flaw within the mwEmbedLoader.php endpoint. This endpoint allows user-controlled ServiceUrl parameters for backend API requests. The internal KalturaClientBase PHP library fetches data from this URL and deserializes it without validation.CVE-2026-19913 allows arbitrary file reads by exploiting the deserialization flaw and improper error handling. An attacker can provide a file:// path to ServiceUrl, causing the player to fetch and attempt to deserialize local file contents. Failed deserialization reflects raw bytes in error messages, revealing sensitive file data.CVE-2026-19912 enables remote code execution due to insufficient sanitization of the uiconf_id parameter. This parameter controls file write locations, allowing directory traversal attacks. An attacker can craft a malicious serialized object with executable PHP code and redirect its deserialized fields to a web-accessible directory.Exploiting these vulnerabilities requires only network access to the affected endpoint; no authentication is needed. Successful attacks can lead to the theft of sensitive information like credentials or API keys. Remote code execution allows for data manipulation, persistence, and further system compromise. These vulnerabilities also affect tenants on Kaltura's shared CDN infrastructure.Until a vendor patch is released, users should restrict or disable external access to mwEmbedLoader.php. Implementing a strict allow-list for ServiceUrl to permit only legitimate API URLs is also recommended.