The Kaltura HTML5 player implements the ServiceUrl parameter in mwEmbedLoader.php without proper validation. The parameter serves as the base URL for backend requests and accepts non‑HTTP schemes such as file://. When an exception occurs, the raw exception content is reflected to the client in an error message. This mechanism allows an unauthenticated, remote attacker to read any internal file reachable by the server, exposing sensitive configuration or code. The weakness aligns with the CWE principles of improper input validation and information exposure.

Affected are the Kaltura HTML5 Video Player and its underlying html5lib library. Vulnerable releases include html5lib v2.45, v2.103 and earlier, and other v2.x releases that expose the mwEmbedLoader.php endpoint. No patch details are provided in the CVE entry, so any version retaining the same code path remains susceptible.

The CVSS score is not disclosed, and the EPSS data is unavailable. However, the vulnerability permits reading arbitrary files on the host, representing a high confidentiality impact and a full remote attack surface. The attack vector is purely remote via crafted ServiceUrl payloads; authentication is not required. While no active exploits are listed, the potential for misuse is significant and the lack of mitigated error handling amplifies the risk.