CVE-2026-19913 in HTML5 Video Player
Summary
by MITRE • 08/25/2026
The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the client in an error message; this enables an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The Kaltura HTML5 player, specifically within its mwEmbed component and associated html5lib library, suffers from a critical local file disclosure vulnerability rooted in improper input validation of the ServiceUrl parameter found in the mwEmbedLoader.php script. This architectural flaw allows an unauthenticated remote attacker to bypass standard security controls by exploiting how the application handles backend request initialization. The ServiceUrl parameter is designed to establish the base URL for subsequent server-side requests, yet it fails to enforce strict protocol restrictions. Consequently, the system accepts non-HTTP schemes such as file://, which are typically reserved for local resource access rather than remote web interactions. This lack of sanitization creates a direct pathway for attackers to manipulate the underlying request logic, turning what should be a standard configuration parameter into an instrument for unauthorized data exfiltration from the server's internal filesystem.
The operational impact of this vulnerability is severe due to the specific error handling mechanism employed by the application. When a backend request fails or triggers an exception during processing, the system attempts to serialize and return detailed diagnostic information to the client. In normal circumstances, such verbose error messages might be acceptable in development environments but are risky in production; however, in this case, they become the delivery vector for sensitive data. Because the ServiceUrl parameter was manipulated to point to a local file path via the file:// scheme, any exception encountered during the attempt to access that resource results in the raw contents of the targeted internal file being reflected directly into the error response sent back to the attacker's browser. This reflection mechanism effectively transforms an application-level bug into a powerful remote file read exploit, allowing adversaries to retrieve configuration files, source code, environment variables, or other sensitive data stored on the server without requiring any form of authentication.
From a technical classification perspective, this vulnerability aligns with CWE-200: Information Exposure and CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) variant where file paths are injected via URL parameters. It also relates to CWE-913: Improper Control of Dynamically-Managed Code Resources, as the application dynamically constructs resource references based on untrusted input without adequate validation. In terms of offensive security frameworks, this exploit maps directly to ATT&CK technique T1083: File and Directory Discovery, where an attacker uses system utilities or API calls to enumerate files, combined with T1560: Archive Collected Data if the retrieved information is packaged for exfiltration. The vulnerability represents a classic case of insecure direct object reference compounded by verbose error handling that leaks internal state details.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Administrators should immediately upgrade to patched versions of html5lib, specifically avoiding v2.45, v2.103, and earlier vulnerable releases within the v2.x series where this endpoint is exposed. If upgrading is not immediately feasible, a temporary workaround involves implementing strict input validation on the ServiceUrl parameter at the web server or application gateway level to reject any URLs containing non-HTTP schemes such as file://, ftp://, or data:. Additionally, developers must enforce secure error handling practices by ensuring that production environments do not reflect raw exception details or stack traces to end-users. Instead, generic error messages should be displayed while detailed logs are recorded securely on the server side for internal review only. This dual approach of input sanitization and controlled information disclosure significantly reduces the attack surface associated with this vulnerability.