CVE-2026-124434: Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions

Published Nov 8, 2026

Updated

Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumboptions shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as account password hashes, 2FA secrets and API keys, into a publicly viewable page.

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs page-editor privileges or another ability to place Lightbox Gallery shortcodes into page content. They can then cause server-readable YAML data to be rendered in a publicly viewable page.

What information could be exposed?

The issue can expose YAML files readable by the server, including account password hashes, two-factor authentication secrets, and API keys. The vulnerability affects confidentiality; the provided data does not indicate direct integrity impact.

What should be prioritized for remediation?

Upgrade the Grav Lightbox Gallery plugin to version 1.3.2 or later. Until it is upgraded, restrict who can edit pages and review shortcode use in pages that may be publicly accessible.

How can I check whether content may have been used to exploit this?

Review page content created or edited by untrusted or lower-privileged editors for Lightbox Gallery shortcodes using the image, thumb, or thumb_options values. Pay particular attention to shortcode values that invoke media methods such as addMetaFile, value, toYaml, or toJson.

CVE-2026-124434: Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

What should be prioritized for remediation?

How can I check whether content may have been used to exploit this?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed?

What should be prioritized for remediation?

How can I check whether content may have been used to exploit this?