Kaltura Html5 Video Player Html5Lib Library
Monthly
Local file disclosure in the Kaltura HTML5 player's mwEmbedLoader.php endpoint allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. The root cause is that the ServiceUrl parameter - used as a base URL for backend requests - accepts non-HTTP URI schemes including file://, which the server then fetches; when an exception is raised, the raw deserialized response is reflected back to the client in the error message, leaking file contents. Affected releases span html5lib v2.45, v2.103, and earlier v2.x versions; no public exploit or KEV listing has been identified at time of analysis, though the attack path is straightforward for any attacker with access to the exposed endpoint.
Local file disclosure in the Kaltura HTML5 player's mwEmbedLoader.php endpoint allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. The root cause is that the ServiceUrl parameter - used as a base URL for backend requests - accepts non-HTTP URI schemes including file://, which the server then fetches; when an exception is raised, the raw deserialized response is reflected back to the client in the error message, leaking file contents. Affected releases span html5lib v2.45, v2.103, and earlier v2.x versions; no public exploit or KEV listing has been identified at time of analysis, though the attack path is straightforward for any attacker with access to the exposed endpoint.