CVE-2026-19913 | defend.network

What is CVE-2026-19913?

The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the client in an error message; this enables an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.

CVSS7.5 NVD 3.1

SeverityHIGH

ExploitationNo exploitation reported

EPSS<1% · P29

Triage statusNo Known Exploit

ActionPatch this week

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWECWE-20

NVD published2026-08-25

NVD last modified2026-09-03

Timeline

2026-08-25Published to the U.S. National Vulnerability Database (NVD)
2026-08-27First covered in a defend.network daily briefing
2026-09-03NVD record last updated

Affected product

See advisory

Remediation Steps

Apply the vendor security update for Kaltura mwEmbed as a priority.
Restrict network exposure of the affected service to trusted sources until patched.
Review logs and detections for indicators of exploitation.
Confirm fixed versions against the official vendor advisory before deploying.

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 4 of August 2026 (August 24 – 30)
Chinese infrastructure disrupted; Kaltura RCE unpatched; NovaCookies targets Microsoft 365 (2026-08-27)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.