CVE-2026-124434Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions

Açıklama

Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as account password hashes, 2FA secrets and API keys, into a publicly viewable page.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-jq4h-4q3q-hr32) vendor-advisory
• VulnCheck Advisory: Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions third-party-advisory