Technical impact
The Kaltura HTML5 player implements the ServiceUrl parameter in mwEmbedLoader.php without proper validation. The parameter serves as the base URL for backend requests and accepts non‑HTTP schemes such as file://. When an exception occurs, the raw exception content is reflected to the client in an error message. This mechanism allows an unauthenticated, remote attacker to read any internal file reachable by the server, exposing sensitive configuration or code. The weakness aligns with the CWE principles of improper input validation and information exposure.
Affected Systems
Affected are the Kaltura HTML5 Video Player and its underlying html5lib library. Vulnerable releases include html5lib v2.45, v2.103 and earlier, and other v2.x releases that expose the vulnerable endpoint. No patch details are provided in the CVE entry, so any version retaining the same code path remains susceptible.
Risk and Exploitability
The CVSS score of 7.5 indicates moderate to high severity, and the EPSS score of less than 1% shows a low probability of exploitation at this time. The vulnerability still permits reading arbitrary files on the host, representing a high confidentiality impact and a full remote attack surface. The attack vector is purely remote via crafted ServiceUrl payloads; authentication is not required. This vulnerability is not listed in CISA KEV, and while no active exploits are listed, the potential for misuse is significant and the lack of mitigated error handling amplifies the risk.
