CVE-2026-19913
Received Received - Intake

Local File Disclosure in Kaltura HTML5 Player

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: CERT/CC

Description
The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the client in an error message; this enables an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-19913
EUVD
EUVD-2026-65615

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
kaltura html5_player From 2.0 (inc) to 3.0 (exc)
kaltura html5_player 2.45
kaltura html5_player 2.103
kaltura html5_player to 2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Kaltura HTML5 player has a flaw where the ServiceUrl parameter in mwEmbedLoader.php is not properly checked. This allows attackers to use non-HTTP schemes like file:// to access internal files. When errors occur, the server reflects raw file contents back to the user, enabling unauthenticated remote file disclosure.

Detection Guidance

To detect this vulnerability, check if the Kaltura HTML5 player (mwEmbed / html5lib) is running versions v2.45, v2.103, or earlier. Inspect the mwEmbedLoader.php file for improper validation of the ServiceUrl parameter, particularly if it accepts non-HTTP schemes like file://. Look for error messages that reflect deserialized responses containing file contents.

Impact Analysis

An attacker could read sensitive files on the server, including configuration files, credentials, or other confidential data. This could lead to further attacks like data theft or system compromise if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR or HIPAA requirements for data protection and confidentiality. Organizations using affected Kaltura versions may face compliance violations and legal penalties.

Mitigation Strategies

Immediately update the Kaltura HTML5 player to a patched version. If an update is unavailable, disable the vulnerable endpoint or restrict access to mwEmbedLoader.php. Implement strict input validation for the ServiceUrl parameter to block non-HTTP schemes like file://. Review server error messages to ensure they do not expose file contents.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19913. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart