CVE-2026-19913

The Kaltura HTML5 player (mwEmbed/html5lib) fails to properly validate the ServiceUrl parameter in mwEmbedLoader.php, which is used as the base URL for a backend request and accepts non-HTTP schemes such as file://. An unauthenticated remote attacker can supply a file:// URL, and when the backend request raises an exception or error, the server deserializes the response and reflects its raw contents back to the client in an error message, disclosing arbitrary files readable by the web server user. An attacker gains read access to internal server files, which may include configuration files or credentials, with confidentiality impact only per the CVSS score. Any deployment exposing the vulnerable mwEmbedLoader.php endpoint is affected, including sites running html5lib v2.45, v2.103 and earlier, and other v2.x releases. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known; EPSS is low at 0.4%, though related reporting indicates additional unpatched mwEmbed flaws, possibly including code execution, may exist.

What to do: Inventory your deployments for mwEmbedLoader.php and check the deployed html5lib version against the affected v2.x releases; since no fixed version is identified in current reporting, apply interim mitigations such as WAF or reverse-proxy rules rejecting non-http(s) ServiceUrl values (especially file://) and limiting filesystem access for the web server user. Monitor Kaltura security advisories for a patched release and for the related unpatched mwEmbed flaws reported alongside this issue, which may include more severe code execution impact.