NVD CVE-2026-19913

nvd.nist.gov • August 26, 2026

This CVE record has recently been published to the CVE List and has been included within the NVD dataset.

The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the client in an error message; this enables an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Kaltura HTML5 Player Expose Organizations to Attacks Two critical vulnerabilities, CVE-2026-19912 and CVE-2026-19913, have been discovered in the Kaltura HTML5 Player Library (mwEmbed/html5lib). These flaws allow unauthenticated remote attackers to execute arbitrary code and read sensitive files on affected servers. The vulnerabilities stem from unsafe deserialization and improper handling of user-controlled parameters in the mwEmbedLoader.php endpoint. Over 600 internet-facing instances are at risk, including those hosted on Kaltura's multi-tenant CDN infrastructure. As of now, no official patches are available, and organizations are advised to restrict access to the vulnerable endpoint. The vulnerabilities have received CVSS scores in the critical range (9.1-10.0), indicating a severe risk to affected systems. Exploitation methods are straightforward, with proof-of-concept code available for both vulnerabilities. The affected versions include html5lib v2.45, v2.103, and earlier releases. 2 sources 73

Extracted Entities

NVD CVE-2026-19913

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)