CVE-2026-19913: Kaltura HTML5 Player File Disclosure Flaw

CVE-2026-19913 Overview

CVE-2026-19913 is a local file disclosure vulnerability in the Kaltura HTML5 player (mwEmbed / html5lib). The flaw resides in mwEmbedLoader.php, which fails to validate the ServiceUrl parameter before using it as the base URL for a backend request. The parameter accepts non-HTTP schemes, including file://, allowing an attacker to point the server at local filesystem resources. When the resulting request produces an error, the server deserializes the response and reflects its raw contents to the client. An unauthenticated remote attacker can read arbitrary internal files reachable by the web server process.

Critical Impact
Unauthenticated remote attackers can disclose sensitive server-side files, including configuration, credentials, and application source code.

Affected Products

Kaltura html5lib v2.45
Kaltura html5lib v2.103 and earlier
Other Kaltura html5lib v2.x releases exposing the vulnerable mwEmbedLoader.php endpoint

Discovery Timeline

2026-08-25 - CVE-2026-19913 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-19913

Vulnerability Analysis

The Kaltura HTML5 player exposes an entry point in mwEmbedLoader.php that accepts a client-controlled ServiceUrl parameter. This parameter is used as the base URL for a subsequent backend request performed by the server. Because input validation does not restrict the URI scheme, attackers can submit values such as file:///etc/passwd or paths pointing at internal configuration files.

When the request fails or triggers an exception, the response body is deserialized by the loader. The raw deserialization output, including the file contents fetched via the file:// scheme, is embedded in the error message returned to the caller. This turns a fetch error path into a reliable file read primitive.

The issue is classified under CWE-20: Improper Input Validation. No authentication or user interaction is required to trigger the flaw.

Root Cause

The root cause is missing scheme and destination validation on the ServiceUrl parameter combined with unsafe error handling. The loader treats any user-supplied URL as trusted and reflects backend response contents verbatim into client-visible error output when deserialization or the underlying request fails.

Attack Vector

An attacker sends an unauthenticated HTTP request to the exposed mwEmbedLoader.php endpoint with a ServiceUrl value using the file:// scheme pointing to a target file on the server. The server fetches the file, attempts to deserialize the contents, fails, and returns the raw file contents inside the error response. The attacker parses the error body to extract the disclosed file.

See the CERT Vulnerability Advisory #308749 for additional technical detail.

Detection Methods for CVE-2026-19913

Indicators of Compromise

HTTP requests to mwEmbedLoader.php containing a ServiceUrl parameter with non-HTTP schemes such as file://, php://, or gopher://.
Error responses from the Kaltura player endpoint containing content resembling local file data (for example, /etc/passwd entries or configuration key/value pairs).
Unusual outbound URI parsing errors or deserialization exceptions logged by the Kaltura application.

Detection Strategies

Inspect web server access logs for requests to mwEmbedLoader.php where the ServiceUrl query parameter does not begin with http:// or https://.
Deploy WAF signatures that flag or block requests where ServiceUrl contains URI schemes other than HTTP or HTTPS.
Correlate 500-class responses from the Kaltura endpoint with request payloads referencing local filesystem paths.

Monitoring Recommendations

Forward Kaltura application and web server logs to a centralized analytics platform for query and alerting on suspicious ServiceUrl values.
Alert on repeated error responses from mwEmbedLoader.php originating from a single source IP within a short interval.
Baseline normal ServiceUrl usage to identify deviations such as encoded schemes or path traversal sequences.

How to Mitigate CVE-2026-19913

Immediate Actions Required

Restrict external access to mwEmbedLoader.php at the perimeter until a fixed version is deployed.
Add WAF or reverse proxy rules that reject requests where ServiceUrl uses any scheme other than http or https.
Audit web server and Kaltura logs for prior exploitation attempts referencing file:// or other non-HTTP schemes.

Patch Information

No vendor patch URL is listed in the enriched CVE data. Administrators should consult the CERT Vulnerability Advisory #308749 and Kaltura vendor channels for updated html5lib releases that address the improper validation of ServiceUrl.

Workarounds

Enforce an allowlist of permitted ServiceUrl hosts and schemes at the application or proxy layer.
Run the Kaltura service under a least-privilege account with restricted filesystem read permissions.
Disable the vulnerable endpoint if it is not required for production functionality.

bash

# Example WAF rule concept (ModSecurity-style) to block non-HTTP ServiceUrl values
SecRule ARGS:ServiceUrl "!@rx ^https?://" \
  "id:1029191,phase:2,deny,status:400,log,msg:'CVE-2026-19913: non-HTTP ServiceUrl scheme blocked'"