CVE-2026-19913

Name of the Vulnerable Software and Affected Versions Kaltura HTML5 player (mwEmbed / html5lib) versions 2.x and earlier

Description A local file disclosure issue exists due to improper validation of the ServiceUrl parameter in the 'mwEmbedLoader.php' endpoint. This parameter, intended as the base URL for backend requests, incorrectly accepts non-HTTP schemes such as file://. When an error occurs, the response is deserialized and the raw contents are reflected to the client in an error message. This allows an unauthenticated remote attacker to read arbitrary internal files accessible by the server. The issue stems from an insecure deserialization flaw that can also lead to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.