CVE-2026-124434 Details

A file read vulnerability has been identified in the Grav Lightbox Gallery plugin versions 1.1.0 prior to 1.3.2, specifically on Grav 2.x. The vulnerability arises because the plugin allows any medium method referenced in the 'image', 'thumb', or 'thumb_options' shortcode values to be called without proper validation against core's allowed media actions. This oversight enables a page editor to exploit the vulnerability by chaining the 'addMetaFile' method with 'value', 'toYaml', or 'toJson' to access server-readable YAML files. Such files may contain sensitive information like account password hashes, 2FA secrets, and API keys, which can then be displayed on a publicly viewable page.

Users can update to Lightbox Gallery version 1.3.2, which addresses the vulnerability by ensuring that media actions in shortcode values are subject to the same rules as core, only calling allowed methods and skipping those that fail or do not return a medium.