Threats tagged 'ghsa-5h77-jjr5-889r'

The Grav Lightbox Gallery plugin versions 1.1.0 up to but not including 1.3.2 on Grav 2.x allows page editors to invoke any medium method named in image, thumb, or thumb_options shortcode values without proper core media action checks. This flaw enables an attacker with page editing privileges to chain methods such as addMetaFile with value, toYaml, or toJson to read server-readable YAML files, potentially exposing sensitive information like account password hashes, two-factor authentication secrets, and API keys in publicly accessible pages.