The vulnerable component is Kaltura's HTML5 Player, specifically the mwEmbedLoader.php endpoint, which accepts a ServiceUrl parameter whose response is passed directly to PHP's unserialize() function. The deserialized object's fields are used to build a cache directory path derived from an attacker‑supplied uiconf_id value without proper validation. Because the resulting path is not sanitized, an attacker can embed directory traversal or absolute path elements to write arbitrary files into web‑exposed locations. Writing a PHP file that is subsequently executed by the web server gives the attacker full control over the server as the web‑server user. This flaw therefore constitutes a remote‑code‑execution vulnerability that requires no authentication.

The vulnerability affects Kaltura's HTML5 Video Player and its html5 library. All releases of the library in the 2.x series up to and including v2.103, and any earlier v2.x releases that expose the mwEmbed endpoint, are impacted. No specific CPE strings were provided in the data.

The flaw carries a high risk because it is unauthenticated and network‑based. An attacker only needs to send a crafted HTTP request containing a controlled ServiceUrl to the vulnerable endpoint to trigger a loss of file‑write control. The EPSS score of less than 1% indicates a low but non‑zero exploitation probability, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the latest data. Nonetheless, the nature of the weakness—unrestricted file write leading to code execution—is well understood to be exploitable with minimal effort when the web application is accessible to the untrusted network. The likely attack vector is a direct HTTP request to the mwEmbedLoader endpoint from an external or internal network.