CVE-2026-124434
Deferred Deferred - Pending Action

Remote File Read via Grav Lightbox Gallery Plugin

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as account password hashes, 2FA secrets and API keys, into a publicly viewable page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124434
EUVD
EUVD-2026-119566

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
getgrav lightbox_gallery From 1.1.0 (inc) to 1.3.1 (inc)
grav lightbox_gallery to 1.3.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Grav Lightbox Gallery plugin versions 1.1.0 to 1.3.1 on Grav 2.x has a vulnerability where page editors can exploit shortcode media actions to read sensitive server files. By chaining methods like addMetaFile with value, toYaml, or toJson, attackers can access YAML files containing password hashes, 2FA secrets, and API keys. These files are then exposed on publicly viewable pages.

Detection Guidance

Check Grav Lightbox Gallery plugin version. If using 1.1.0 to 1.3.1, the system is vulnerable. Inspect Grav logs for unusual shortcode media action calls or file read attempts in publicly accessible pages.

Impact Analysis

This vulnerability allows unauthorized users to read sensitive files on the server, including password hashes, 2FA secrets, and API keys. If exploited, attackers could gain access to user accounts, sensitive configurations, or other confidential data stored in YAML files.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data breaches exposing personal data), HIPAA (exposure of protected health information), and other regulations requiring protection of sensitive data. Unauthorized access to credentials or API keys may also violate security policies.

Mitigation Strategies

Upgrade Grav Lightbox Gallery plugin to version 1.3.2 or later immediately. Review and restrict page editor permissions to prevent unauthorized shortcode usage. Audit recent page changes for suspicious embeds of sensitive files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124434. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...