Description
Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as account password hashes, 2FA secrets and API keys, into a publicly viewable page.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| getgrav | grav | 1.1.0 – < 1.3.2 | 1.3.2 |
References
- GitHub Security Advisory (GHSA-jq4h-4q3q-hr32) vendor-advisory
- VulnCheck Advisory: Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions third-party-advisory