CVE-2026-19913

HighCVSS 7.5/10Last modified Sep 3, 2026

Description

The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the client in an error message; this enables an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20 CWE-73

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 25, 2026
Last modified: Sep 3, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-199147.2The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' parameter in all versions up CVE-2026-199157.3A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.55.10.0. The vulnerability could CVE-2026-199163.5A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function of the file edit_foo CVE-2026-199176.3A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file delete_food_ite CVE-2026-199186.3A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function get_status of the component g CVE-2026-199197.3A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the compon CVE-2026-19928.8The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Insecure Direct Object Reference in versions 8.6.0 throu CVE-2026-199206.3A vulnerability was determined in code-projects Online Shopping System 1.0. Affected is an unknown function of the file /action.php. This ma CVE-2026-199216.3A vulnerability was identified in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of th CVE-2026-199223.5A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the CVE-2026-199236.3A weakness has been identified in code-projects Online Shopping System 1.0. This affects an unknown part of the file /checkout_process.php. CVE-2026-199249.8A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHand