CVE-2026-19913 CVE-2026-19913
Unauthenticated attackers can read arbitrary internal files via improper validation of the ServiceUrl parameter in the Kaltura HTML5 player library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19913?
CVE-2026-19913 is a high-severity server-side request forgery vulnerability in Kaltura HTML5 Video Player, html5lib library, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the client in an error message; this enables an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.
Which versions are affected by CVE-2026-19913?
How do I fix CVE-2026-19913?
No fix has been published for CVE-2026-19913 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-19913 being exploited?
There is no known exploitation of CVE-2026-19913 in the wild and no public exploit code.
Sources
Also known as GHSA-7hc5-vghm-cr8h.