Cpe:2.3:a:grav:lightbox_gallery_plugin:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3agravlightbox_gallery_plugin/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 15:30:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgGrav Lightbox Gallery: Arbitrary file read via insecure method calls (CVE-2026-124434)https://feed.craftedsignal.io/briefs/2026-11-grav-lightbox-gallery/Sun, 08 Nov 2026 15:30:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-grav-lightbox-gallery/The Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x allows page editors to read server-readable files by invoking unauthorized media methods.<p>The Grav Lightbox Gallery plugin (1.1.0 before 1.3.2) on Grav 2.x calls medium methods named in image, thumb, or thumb_options shortcode values without checking the core's allowed media actions. A page editor can chain addMetaFile with value, toYaml, or toJson to read server-readable YAML files - such as account password hashes, 2FA secrets, and API keys - into a publicly viewable page.</p> highadvisory