Bug 2523656 (CVE-2026-19913)
| Summary: | CVE-2026-19913 mwEmbed: html5lib: Kaltura HTML5 Player: Information disclosure via improper validation of ServiceUrl parameter | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | akhatavk, anthomas, aos-team-art-private, aruklets, asdas, dfreiber, doconnor, dpaolell, drow, dschmidt, ehelms, ggainey, jburrell, jdelft, jlanda, jpasqual, jupierce, juwatts, kshier, lgarciaa, mbiarnes, mdellweg, mhulan, nmoumoul, osousa, pcreech, ppalepu, ppostler, prdhamdh, rchan, rhel-process-autobot, sghai, sidsharm, simaishi, smallamp, stcannon, suppawar, teagle, tmalecek, vkumar, vlaad, watson-tool-maintainers, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the Kaltura HTML5 player (mwEmbed / html5lib). An unauthenticated, remote attacker can exploit improper validation of the `ServiceUrl` parameter in `mwEmbedLoader.php`. This parameter, used for backend requests, accepts non-HTTP schemes such as `file://`. When an exception or error occurs, the response is deserialized and its raw contents are reflected to the client, allowing the attacker to read arbitrary internal files on the server. This leads to information disclosure.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-08-25 16:46:47 UTC
|