Bug 2523656 (CVE-2026-19913)

Summary: CVE-2026-19913 mwEmbed: html5lib: Kaltura HTML5 Player: Information disclosure via improper validation of ServiceUrl parameter
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, anthomas, aos-team-art-private, aruklets, asdas, dfreiber, doconnor, dpaolell, drow, dschmidt, ehelms, ggainey, jburrell, jdelft, jlanda, jpasqual, jupierce, juwatts, kshier, lgarciaa, mbiarnes, mdellweg, mhulan, nmoumoul, osousa, pcreech, ppalepu, ppostler, prdhamdh, rchan, rhel-process-autobot, sghai, sidsharm, simaishi, smallamp, stcannon, suppawar, teagle, tmalecek, vkumar, vlaad, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Kaltura HTML5 player (mwEmbed / html5lib). An unauthenticated, remote attacker can exploit improper validation of the `ServiceUrl` parameter in `mwEmbedLoader.php`. This parameter, used for backend requests, accepts non-HTTP schemes such as `file://`. When an exception or error occurs, the response is deserialized and its raw contents are reflected to the client, allowing the attacker to read arbitrary internal files on the server. This leads to information disclosure.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-25 16:46:47 UTC
The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the client in an error message; this enables an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.