CVE-2026-19913

UNKNOWN 0.0

CVE-2026-19913

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the client in an error message; this enables an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.

Vendor	kaltura
Product	kaltura html5 video player, html5lib library
Published	Aug 25, 2026
Last Updated	Aug 25, 2026

Stay Ahead of the Next One

Get instant alerts for kaltura kaltura html5 video player, html5lib library

Be the first to know when new unknown vulnerabilities affecting kaltura kaltura html5 video player, html5lib library are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Kaltura / Kaltura HTML5 Video Player, html5lib library

0 ≤ v2.103 2.45

References

NVD ↗ CVE.org ↗ EPSS Data ↗

kb.cert.org: https://kb.cert.org/vuls/id/308749