CVE-2026-19913 | defend.network

What is CVE-2026-19913?

The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the client in an error message; this enables an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.

CVSS7.5 NVD 3.1

SeverityHIGH

ExploitationNo exploitation reported

EPSS<1% · P8

Triage statusNo Known Exploit

ActionPatch this week

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWECWE-20

NVD published2026-08-25

NVD last modified2026-08-26

Timeline

2026-08-25Published to the U.S. National Vulnerability Database (NVD)
2026-08-26NVD record last updated
2026-08-27First covered in a defend.network daily briefing

Affected product

See advisory

Remediation Steps

Identify all instances of Kaltura mwEmbed deployed in your environment
Contact Kaltura or monitor their security advisories for available patches
Apply vendor patches as soon as released
Restrict unauthenticated access to the mwEmbedLoader.php endpoint where feasible

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 4 of August 2026 (August 24 – 30)
Chinese infrastructure disrupted; Kaltura RCE unpatched; NovaCookies targets Microsoft 365 (2026-08-27)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.