{"id":"CVE-2026-124434","kind":"vulnerability","aliases":["CVE-2026-124434"],"related":[],"title":"Grav Lightbox Gallery plugin lets page editors read server secrets into pages","description":"Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as account password hashes, 2FA secrets and API keys, into a publicly viewable page.","summary":"The Grav Lightbox Gallery plugin calls any media method named in image, thumb or thumb_options shortcode values without the core allowed-action check. A page editor can chain addMetaFile with value, toYaml or toJson to copy server YAML files, such as password hashes, 2FA secrets and API keys, into a publicly viewable page.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["grav","lightbox-gallery","package","php","self-hosted"],"not_affected_if":["grav-1.x","no-lightbox-plugin","trusted-editors-only"],"how_to_check":"- Check the installed version of the Grav Lightbox Gallery plugin in the plugin's blueprint or `composer.json`, and confirm whether it is below `1.3.2`.\n- Confirm the site runs Grav 2.x.\n- Look for `lightbox` shortcode use in pages that editors can write.","fix":"- Grav Lightbox Gallery plugin: `1.3.2` or later (per the advisory range, 1.1.0 before 1.3.2).","status":"open","published_at":"2026-11-08T14:18:09+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","triaged_at":"2026-11-08T14:49:52+00:00","updated_at":"2026-11-08T14:49:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T14:49:52Z","model":"claude-haiku-5-5","output":{"fix":"- Grav Lightbox Gallery plugin: `1.3.2` or later (per the advisory range, 1.1.0 before 1.3.2).","reach":"network","title":"Grav Lightbox Gallery plugin lets page editors read server secrets into pages","impact":"high","summary":"The Grav Lightbox Gallery plugin calls any media method named in image, thumb or thumb_options shortcode values without the core allowed-action check. A page editor can chain addMetaFile with value, toYaml or toJson to copy server YAML files, such as password hashes, 2FA secrets and API keys, into a publicly viewable page.","audience":"developers","category":"package","nicknames":[],"who_cares":["grav","lightbox-gallery","php","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Server secrets such as password hashes and API keys become publicly readable","analyst_note":"","how_to_check":"- Check the installed version of the Grav Lightbox Gallery plugin in the plugin's blueprint or `composer.json`, and confirm whether it is below `1.3.2`.\n- Confirm the site runs Grav 2.x.\n- Look for `lightbox` shortcode use in pages that editors can write.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-lightbox-plugin","grav-1.x","trusted-editors-only"],"who_is_affected":"Sites running the Grav Lightbox Gallery plugin from 1.1.0 up to but not including 1.3.2 on Grav 2.x, where page editors can write shortcode values. Exposure comes from the plugin passing user-supplied media method names through without core's allowed-action check. Sites without the plugin, on Grav 1.x, or where only trusted administrators edit pages are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000798,"input_tokens":4644,"output_tokens":668,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124434':15A,18A '-2026':14A,17A '1.1.0':87C '1.3.2':89C '2':92C '2fa':73B,137C 'account':134C 'action':51B,112C 'addmetafil':58B,119C 'allow':50B,110C 'allowed-act':49B 'api':76B,140C 'call':33B,94C 'chain':57B,118C 'check':52B,113C 'copi':65B 'core':48B,108C 'cve':13A,16A 'editor':7A,55B,116C 'file':68B,131C 'galleri':3A,22B,31B,85C 'grav':1A,19B,29B,83C,91C 'hash':72B,136C 'host':27B 'imag':39B,100C 'key':77B,141C 'let':5A 'lightbox':2A,21B,30B,84C 'lightbox-galleri':20B 'media':35B,111C 'medium':96C 'method':36B,97C 'name':37B,98C 'option':43B,104C 'packag':23B 'page':6A,12A,54B,82B,115C,146C 'password':71B,135C 'php':24B 'plugin':4A,32B,86C 'public':80B,144C 'read':8A,126C 'readabl':129C 'secret':10A,74B,138C 'self':26B 'self-host':25B 'server':9A,66B,128C 'server-read':127C 'shortcod':44B,105C 'thumb':40B,42B,101C,103C 'tojson':63B,124C 'toyaml':61B,122C 'valu':45B,60B,106C,121C 'viewabl':81B,145C 'without':46B,107C 'x':93C 'yaml':67B,130C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Grav Lightbox Gallery plugin from 1.1.0 up to but not including 1.3.2 on Grav 2.x, where page editors can write shortcode values. Exposure comes from the plugin passing user-supplied media method names through without core's allowed-action check. Sites without the plugin, on Grav 1.x, or where only trusted administrators edit pages are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["grav","high","lightboxgallery","package","php","selfhosted"],"campaign_type":null,"search_a":"'-124434':15A,18A '-2026':14A,17A 'cve':13A,16A 'editor':7A 'galleri':3A 'grav':1A 'let':5A 'lightbox':2A 'page':6A,12A 'plugin':4A 'read':8A 'secret':10A 'server':9A","search_b":"'2fa':73B 'action':51B 'addmetafil':58B 'allow':50B 'allowed-act':49B 'api':76B 'call':33B 'chain':57B 'check':52B 'copi':65B 'core':48B 'editor':55B 'file':68B 'galleri':22B,31B 'grav':19B,29B 'hash':72B 'host':27B 'imag':39B 'key':77B 'lightbox':21B,30B 'lightbox-galleri':20B 'media':35B 'method':36B 'name':37B 'option':43B 'packag':23B 'page':54B,82B 'password':71B 'php':24B 'plugin':32B 'public':80B 'secret':74B 'self':26B 'self-host':25B 'server':66B 'shortcod':44B 'thumb':40B,42B 'tojson':63B 'toyaml':61B 'valu':45B,60B 'viewabl':81B 'without':46B 'yaml':67B","search_c":"'1.1.0':87C '1.3.2':89C '2':92C '2fa':137C 'account':134C 'action':112C 'addmetafil':119C 'allow':110C 'api':140C 'call':94C 'chain':118C 'check':113C 'core':108C 'editor':116C 'file':131C 'galleri':85C 'grav':83C,91C 'hash':136C 'imag':100C 'key':141C 'lightbox':84C 'media':111C 'medium':96C 'method':97C 'name':98C 'option':104C 'page':115C,146C 'password':135C 'plugin':86C 'public':144C 'read':126C 'readabl':129C 'secret':138C 'server':128C 'server-read':127C 'shortcod':105C 'thumb':101C,103C 'tojson':124C 'toyaml':122C 'valu':106C,121C 'viewabl':145C 'without':107C 'x':93C 'yaml':130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-24T04:18:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124434","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124434","severity":null,"published_at":"2026-11-08T14:18:09+00:00","modified_at":"2026-11-08T14:18:09+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","fetched_at":"2026-11-08T14:48:38+00:00","note":null}],"documents":[{"id":102052,"url":"https://github.com/getgrav/grav/security/advisories/GHSA-jq4h-4q3q-hr32","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-24T04:18:19+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102053,"url":"https://www.vulncheck.com/advisories/grav-lightbox-gallery-1.1.0-before-1.3.2-file-read-via-shortcode-media-actions","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}