CVE-2026-19913

Awaiting Analysis Awaiting Analysis - Queue

Local File Disclosure in Kaltura HTML5 Player

Publication date: 2026-08-25

Last updated on: 2026-09-03

Assigner: CERT/CC

Description

The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the client in an error message; this enables an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-09-03

Generated

2026-09-14

AI Q&A

2026-08-25

EPSS Evaluated

2026-09-13

NVD

CVE-2026-19913

EUVD

EUVD-2026-65615

Affected Vendors & Products

Vendor	Product	Version / Range
kaltura	html5_player	From 2.0 (inc) to 3.0 (exc)
kaltura	html5_player	2.45
kaltura	html5_player	2.103
kaltura	html5_player	to 2.0 (exc)
kaltura	html5_player_library	2.45
kaltura	html5_player_library	2.103
kaltura	html5_player_library	to 2.45 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

The Kaltura HTML5 player has a flaw where the ServiceUrl parameter in mwEmbedLoader.php is not properly checked. This allows attackers to use non-HTTP schemes like file:// to access internal files. When errors occur, the server reflects raw file contents back to the user, enabling unauthenticated remote file disclosure.

Detection Guidance

To detect this vulnerability, check if the Kaltura HTML5 player (mwEmbed / html5lib) is running versions v2.45, v2.103, or earlier. Inspect the mwEmbedLoader.php file for improper validation of the ServiceUrl parameter, particularly if it accepts non-HTTP schemes like file://. Look for error messages that reflect deserialized responses containing file contents.

Impact Analysis

An attacker could read sensitive files on the server, including configuration files, credentials, or other confidential data. This could lead to further attacks like data theft or system compromise if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR or HIPAA requirements for data protection and confidentiality. Organizations using affected Kaltura versions may face compliance violations and legal penalties.

Mitigation Strategies

Immediately update the Kaltura HTML5 player to a patched version. If an update is unavailable, disable the vulnerable endpoint or restrict access to mwEmbedLoader.php. Implement strict input validation for the ServiceUrl parameter to block non-HTTP schemes like file://. Review server error messages to ensure they do not expose file contents.

Hi! I’m here to help you understand CVE-2026-19913. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70