CVE-2026-124434 · Package
NO FIX YET · SEE WHAT TO DO
The Grav Lightbox Gallery plugin calls any media method named in image, thumb or thumb_options shortcode values without the core allowed-action check. A page editor can chain addMetaFile with value, toYaml or toJson to copy server YAML files, such as password hashes, 2FA secrets and API keys, into a publicly viewable page.
first public Oct 24, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Grav Lightbox Gallery plugin from 1.1.0 up to but not including 1.3.2 on Grav 2.x, where page editors can write shortcode values. Exposure comes from the plugin passing user-supplied media method names through without core's allowed-action check. Sites without the plugin, on Grav 1.x, or where only trusted administrators edit pages are less exposed.
Not affected if grav-1.x, no-lightbox-plugin, trusted-editors-only
Who cares grav, lightbox-gallery, php, self-hosted
composer.json, and confirm whether it is below 1.3.2.lightbox shortcode use in pages that editors can write.1.3.2 or later (per the advisory range, 1.1.0 before 1.3.2).Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as account password hashes, 2FA secrets and API keys, into a publicly viewable page.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.