CVE-2026-19913: Kaltura HTML5 Player Local File Disclosure - What It Means for Your Business and How to Respond

CVE-2026-19913: Kaltura HTML5 Player Local File Disclosure - What It Means for Your Business and How to Respond

A high-severity vulnerability in the Kaltura HTML5 Player library allows unauthenticated attackers to read arbitrary files from affected servers. Organizations across the United States and Canada that rely on Kaltura for video delivery, education platforms, enterprise streaming, or media services face potential exposure of configuration files, credentials, and other sensitive data. This post explains why the issue matters to business leaders, outlines who is most at risk, and provides clear guidance on assessing exposure and responding effectively. Technical details appear only in the appendix for security and IT teams.

Background & History

CVE-2026-19913 was publicly disclosed on August 25, 2026, by the CERT Coordination Center under vulnerability note VU#308749. The flaw affects the Kaltura HTML5 Player (also known as mwEmbed or html5lib), specifically legacy Player V2 versions including v2.45, v2.103 and earlier releases that expose the vulnerable endpoint. Researcher Gerjan Wemekamp of AndDone reported the issue. It carries a CVSS 3.1 base score of 7.5 (High) and involves improper validation that enables local file disclosure. Key timeline points include vendor notification in early July 2026, public disclosure in late August, and subsequent confirmation that patches for affected legacy versions became available. The currently supported Kaltura Player V7 is not affected. The vulnerability is unrelated to the separate Python html5lib package.

What This Means for Your Business

If your organization uses Kaltura technology for video hosting, streaming, learning management, or content delivery, this vulnerability creates direct risk to confidential information stored on or accessible to the server. An attacker who can reach the affected component may retrieve internal files containing database credentials, API keys, configuration details, or other secrets. That exposure can lead to further compromise of operations, disruption of video services that employees, students, or customers depend on, and potential data leakage that triggers breach-notification obligations under Canadian provincial privacy laws or U.S. state and federal requirements. Reputation damage follows quickly when video platforms that support training, marketing, or public-facing content become the source of a security incident. Compliance teams must also consider whether exposed data falls under regulated categories, increasing the likelihood of regulatory scrutiny and associated costs. Even if your primary Kaltura deployment runs a newer player, any lingering legacy components or shared infrastructure can still create exposure that business leaders need to address promptly.

Real-World Examples

Regional financial institution: A mid-sized bank in the Midwest uses an older Kaltura player for internal training videos and customer education content. An attacker reads configuration files containing database credentials, enabling deeper access that disrupts compliance training systems and forces costly emergency response and notification processes.

Canadian university system: A provincial university relies on Kaltura for lecture capture and online course delivery. File disclosure exposes administrative credentials and student-related configuration data, creating privacy obligations under applicable Canadian legislation and interrupting remote learning for thousands of students during a critical academic period.

Healthcare provider network: A multi-site healthcare organization streams continuing education and patient-facing videos through a self-hosted Kaltura instance. Sensitive internal files are read, raising concerns about protected health information environments and requiring immediate isolation of the video platform while operations continue under heightened monitoring.

Media and broadcasting firm: A Canadian broadcaster or U.S. content distributor running legacy player components on shared infrastructure faces the risk that an attacker obtains credentials usable across multiple tenants, potentially affecting content availability and forcing rapid credential rotation and service reviews.

Am I Affected?

• You operate any Kaltura HTML5 Player (mwEmbed / html5lib) version in the v2.x series, including v2.45, v2.103, or earlier releases that expose the mwEmbedLoader.php endpoint.
• Your environment still uses the legacy Player V2 rather than the currently supported Player V7.
• The affected endpoint is reachable from the internet or from untrusted internal networks.
• You host Kaltura yourself or rely on shared multi-tenant infrastructure that has not yet been confirmed as fully patched.
• You cannot immediately confirm that all instances have received the vendor-released patches for the legacy player.
• Video delivery, training platforms, or media services depend on components that have not been inventoried for this specific library version.

Key Takeaways

• CVE-2026-19913 is a high-severity local file disclosure issue in the legacy Kaltura HTML5 Player that can expose credentials and sensitive configuration data without authentication.
• Business impact centers on potential data exposure, service disruption, regulatory notification duties in the United States and Canada, and reputational harm.
• Organizations still running Player V2 components face the highest risk and should prioritize inventory and remediation.
• Immediate restriction of the vulnerable endpoint combined with prompt patching or migration to Player V7 sharply reduces exposure.
• A structured response that includes verification, interim controls, and longer-term modernization protects operations more effectively than isolated technical fixes.

Call to Action

Understanding your exposure to CVE-2026-19913 and similar risks requires more than a checklist. IntegSec helps organizations across the United States and Canada identify residual vulnerabilities, validate controls, and reduce overall cyber risk through professional penetration testing. Contact us today at https://integsec.com to schedule an assessment and strengthen your defenses with practical, business-aligned recommendations.

TECHNICAL APPENDIX
(security engineers, pentesters, IT professionals only)

A — Technical Analysis

The root cause is improper validation of the ServiceUrl parameter in mwEmbedLoader.php within the Kaltura HTML5 Player (mwEmbed / html5lib). The parameter is used as the base URL for backend requests and accepts non-HTTP schemes such as file://. The KalturaClientBase PHP client fetches the response and passes it to unserialize() without adequate source, scheme, or content checks. When deserialization fails, the raw file contents are reflected in the error message returned to the client. This enables unauthenticated remote arbitrary file read of any file accessible to the web-server process. Attack vector is network, complexity is low, privileges required are none, and user interaction is none. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Primary CWE associations include CWE-20 (Improper Input Validation), CWE-73 (External Control of File Name or Path), and CWE-918 (Server-Side Request Forgery) in some classifications. Reference the NVD entry for CVE-2026-19913 and CERT VU#308749.

B — Detection & Verification

Version enumeration can be performed by examining installed package versions or by inspecting the player library files for the presence of mwEmbedLoader.php and associated html5lib version strings in the v2.x range. Vulnerability scanners may flag the endpoint when ServiceUrl accepts non-HTTP schemes. Log indicators include requests to mwEmbedLoader.php containing ServiceUrl parameters with file:// or other unexpected schemes, followed by error responses that contain unexpected file content. Behavioral anomalies appear as unexplained reads of system files or configuration paths by the web-server user. Network indicators include inbound requests targeting the loader endpoint with crafted ServiceUrl values originating from untrusted sources. Confirmation requires controlled testing in a non-production environment that mirrors the production configuration.

C — Mitigation & Remediation

1. Immediate (0–24h): Restrict or disable external and untrusted access to the mwEmbedLoader.php endpoint via web-server configuration, firewall rules, or reverse-proxy controls. Enforce a strict allow-list for any remaining ServiceUrl values that permits only expected HTTP/HTTPS backend API destinations.
2. Short-term (1–7d): Apply the vendor-released patches for all affected legacy Player V2 / html5lib v2.x installations. Prefer migration to the supported Kaltura Player V7 where feasible. Rotate any credentials or secrets that may have been exposed on systems confirmed or suspected to be vulnerable.
3. Long-term (ongoing): Maintain an accurate inventory of all Kaltura player components, enforce regular patching cadence for media libraries, and implement continuous monitoring for anomalous access to player endpoints. Prefer supported player versions and remove legacy components that are no longer required.

Official vendor patches for the legacy versions should be prioritized. Environments that cannot patch immediately must keep the endpoint isolated and monitor closely until remediation is complete.

D — Best Practices

• Validate and restrict all user-controlled URL or path parameters to a strict allow-list of expected schemes and destinations.
• Avoid deserializing untrusted or externally sourced data; prefer safer data interchange formats and explicit validation.
• Isolate legacy media player components from sensitive configuration and credential stores.
• Continuously inventory and phase out unsupported or end-of-life player libraries in favor of currently maintained versions.
• Apply defense-in-depth controls that limit the blast radius of any single component, including network segmentation around video delivery infrastructure.