CVE-2026-19913

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-19913

The Kaltura HTML5 player (mwEmbed / html5lib) is vulnerable to local file disclosure in versions v2.45, v2.103 and earlier , and other v2.x releases. The root cause is the improper validation of the ServiceUrl parameter in mwEmbedLoader.php, which accepts non-HTTP schemes like file://. Due to an ...

EUVD-2026-65614

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Overview The Kaltura HTML5 Player V2 Library mwEmbed / html5lib contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code execution. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases tha...