CVE-2026-124434Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions

Beschreibung

Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as account password hashes, 2FA secrets and API keys, into a publicly viewable page.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-jq4h-4q3q-hr32) vendor-advisory
• VulnCheck Advisory: Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions third-party-advisory