Grav Lightbox Gallery: Arbitrary file read via insecure method calls (CVE-2026-124434)
The Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x allows page editors to read server-readable files by invoking unauthorized media methods.
CVE search metadata
CVE search record: CVE-2026-124434. Severity: high. CVSS: 7.1. KEV: no. Product: Lightbox Gallery plugin (< 1.3.2). Brief: Grav Lightbox Gallery: Arbitrary file read via insecure method calls (CVE-2026-124434). Brief link: https://feed.craftedsignal.io/briefs/2026-11-grav-lightbox-gallery/
Triage facts
Revision 1- Applicability
- Lightbox Gallery plugin (< 1.3.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 15:30 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Grav Lightbox Gallery plugin (1.1.0 before 1.3.2) on Grav 2.x calls medium methods named in image, thumb, or thumb_options shortcode values without checking the core's allowed media actions. A page editor can chain addMetaFile with value, toYaml, or toJson to read server-readable YAML files - such as account password hashes, 2FA secrets, and API keys - into a publicly viewable page.