CVE-2026-19913 Kaltura CVE debrief

Who should care

Organizations using the Kaltura HTML5 player, particularly those with sensitive internal files or configurations, should prioritize patching and inventory checks to mitigate potential local file disclosure risks.

Technical summary

The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non-HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the client in an error message; this enables an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server.

Defensive priority

Organizations using the Kaltura HTML5 player should prioritize patching and inventory checks to mitigate potential local file disclosure risks.

Recommended defensive actions

• Apply patches or updates to the Kaltura HTML5 player to address the local file disclosure vulnerability
• Conduct inventory checks to identify and update vulnerable instances of the Kaltura HTML5 player
• Implement compensating controls such as monitoring and exception tracking to detect potential exploitation attempts
• Verify the ServiceUrl parameter validation in the mwEmbedLoader.php file and restrict it to only accept HTTP schemes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description indicates a local file disclosure vulnerability in the Kaltura HTML5 player due to improper validation of the ServiceUrl parameter. The vulnerability allows an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint. However, specific details about the versions and the exact scope of the vulnerability are limited in the provided source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.