Is CVE-2026-124434 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124434 being exploited in the wild.

How severe is CVE-2026-124434?

High severity, with a CVSS score of 7.1, published 8 November 2026.

Which products and versions are affected?

Getgrav Lightbox Gallery 1.1.0 through 1.3.1 on Grav 2.x.

Is there a fix for CVE-2026-124434?

Yes: fixed in Lightbox Gallery 1.3.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124434 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-124434?

Check whether you run Getgrav Lightbox Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124434: Grav Lightbox Gallery plugin arbitrary method invocation in shortcode

CVE-2026-124434 · Severity: high · CVSS 7.1 · Published 2026-11-08

The Lightbox Gallery plugin for Grav content management system allows page editors to call arbitrary methods on media objects through shortcode parameters without proper validation. An attacker with page-edit permissions can exploit this to read sensitive server files—such as password hashes, API keys, and 2FA secrets—and publish them publicly on web pages visible to anonymous visitors.

Vendors: Getgrav.

Quick answers

Is CVE-2026-124434 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124434 being exploited in the wild.
How severe is CVE-2026-124434?: High severity, with a CVSS score of 7.1, published 8 November 2026.
Which products and versions are affected?: Getgrav Lightbox Gallery 1.1.0 through 1.3.1 on Grav 2.x.
Is there a fix for CVE-2026-124434?: Yes: fixed in Lightbox Gallery 1.3.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124434 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-124434?: Check whether you run Getgrav Lightbox Gallery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Lightbox Gallery 1.3.2

Technical details

The plugin processes shortcode values (image, thumb, thumb_options) by parsing query strings and calling arbitrary public methods on media objects, bypassing Grav core's allowed media action check. An attacker can chain the addMetaFile method with accessors like value, toYaml, or toJson to load and expose YAML files readable by the web server. The vulnerability requires an attacker with page-edit permission and is triggered when shortcode values are processed.

Affected products

getgrav Lightbox Gallery 1.1.0 through 1.3.1 on Grav 2.x

Timeline

2026-10-24: disclosed
2026-11-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.