An unauthenticated local file disclosure vulnerability in the Kaltura HTML5 Video Player enables remote attackers to access sensitive internal files, presenting a high risk to data confidentiality.

The application fails to properly validate the ServiceUrl parameter within the mwEmbedLoader.php file, which permits the use of non-HTTP schemes such as file://. An unauthenticated attacker can exploit this to read arbitrary internal files, as error responses are deserialized and reflected back to the client.

The ability for an unauthenticated user to retrieve arbitrary files from the host server poses a significant threat to organizational security. Attackers may gain access to sensitive configuration files, environment variables, or system credentials, which could lead to a complete compromise of the underlying infrastructure. With a CVSS score of 7.5, this vulnerability is classified as high severity, reflecting the ease of exploitation and the potential for unauthorized data exfiltration.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor vendor security advisories and the Kaltura knowledge base for release updates. If an update is not yet available, restrict access to the affected mwEmbedLoader.php endpoint at the network or application layer.

Proactive Monitoring: Review web server access logs for requests containing file:// URI schemes or unusual parameter strings targeting the mwEmbedLoader.php script.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or sanitize requests that attempt to pass non-HTTP/HTTPS schemes into the ServiceUrl parameter.

Public Exploit Available: No

Given the potential for unauthorized access to sensitive internal data, this vulnerability must be treated with high priority. Organizations using the Kaltura HTML5 Video Player should audit their implementations immediately and apply restrictive access controls to mitigate the exposure of the vulnerable endpoint until an official vendor patch is released.