CVE-2026-124434 Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions

High 7.1 Published 8 Nov 2026 Updated 12 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-124434?

CVE-2026-124434 is a high-severity vulnerability in getgrav grav, published on 8 Nov 2026.

Official description

Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as account password hashes, 2FA secrets and API keys, into a publicly viewable page.

Weakness: CWE-200

Which versions are affected by CVE-2026-124434?

How do I fix CVE-2026-124434?

No fix has been published for CVE-2026-124434 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-124434 being exploited?

There is no known exploitation of CVE-2026-124434 in the wild and no public exploit code.

Sources

Also known as GHSA-5h77-jjr5-889r, GHSA-jq4h-4q3q-hr32.