AI analysis
The Kaltura HTML5 player (mwEmbed/html5lib) fails to properly validate the ServiceUrl parameter in mwEmbedLoader.php, which is used as the base URL for a backend request and accepts non-HTTP schemes such as file://. An unauthenticated remote attacker can supply a file:// URL, and when the backend request raises an exception or error, the server deserializes the response and reflects its raw contents back to the client in an error message, disclosing arbitrary files readable by the web server user. An attacker gains read access to internal server files, which may include configuration files or credentials, with confidentiality impact only per the CVSS score. Any deployment exposing the vulnerable mwEmbedLoader.php endpoint is affected, including sites running html5lib v2.45, v2.103 and earlier, and other v2.x releases. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known; EPSS is low at 0.4%, though related reporting indicates additional unpatched mwEmbed flaws, possibly including code execution, may exist.
What to do: Inventory your deployments for mwEmbedLoader.php and check the deployed html5lib version against the affected v2.x releases; since no fixed version is identified in current reporting, apply interim mitigations such as WAF or reverse-proxy rules rejecting non-http(s) ServiceUrl values (especially file://) and limiting filesystem access for the web server user. Monitor Kaltura security advisories for a patched release and for the related unpatched mwEmbed flaws reported alongside this issue, which may include more severe code execution impact.
Affected
| Kaltura html5lib / mwEmbed HTML5 player (mwEmbedLoader.php) | v2.103 and earlier (including v2.45) and other v2.x releases exposing the vulnerable mwEmbedLoader.php endpoint; no fixed release identified in available report |
Estimated exposure
largelikely tens of thousands of internet-exposed mwEmbedLoader.php endpoints (estimate; no public scan counts published) — Kaltura's player is embedded across its hosted platform and self-hosted Community Edition deployments at universities, media companies and enterprises, where the loader script is typically reachable from the internet, so the order of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the client in an error message; this enables an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.