The Kaltura HTML5 player contains an unauthenticated remote code execution flaw caused by unsafe data deserialization and unsanitized filesystem paths. The mwEmbedLoader.php module accepts a user‑controlled ServiceUrl, processes the response with PHP’s unserialize(), and writes fields to a cache path derived from the attacker‑supplied uiconf_id. Because the path is not validated, an attacker can create arbitrary files in web‑accessible locations and execute code as the webserver user. The vulnerability is a classic unsafe deserialization weakness, allowing full control over the server’s filesystem and code execution.

Affected systems are Kaltura HTML5 Video Player and its html5 library versions up to v2.103, including all earlier v2.x releases that expose the mwEmbedLoader endpoint. The specific product is Kaltura, and the vulnerable component is the mwEmbedLoader.php script within the Kaltura HTML5 player.

The flaw carries a high severity; the lack of authentication and the direct file write capability make exploitation trivial for any attacker who can direct a web request to the vulnerable endpoint. The EPSS score is unavailable, but the vulnerability is not listed in CISA KEV. The nature of the exploit—remote deserialization leading to arbitrary file writes—means that once exploited, the attacker gains persistent code execution on the affected webserver. The attack vector is clearly network‑based, relying on a crafted ServiceUrl parameter sent over HTTP. The CVE description itself confirms that this is an unauthenticated RCE pathway.