CVE-2026-109326 Details
Description
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.
An information disclosure vulnerability exists in Grav versions prior to 2.1.7. This issue arises because the default configurations for nginx, lighttpd, IIS, and Caddy 2 only block access to the .git directory at the document root level. As a result, unauthenticated attackers can access nested repositories, such as user/.git, to obtain Git configuration files, references, and objects. This access could be used to reconstruct unpublished commit history or retrieve sensitive information inadvertently included in commits.
Users are advised to update to Grav version 2.1.3 or later. Additionally, it is recommended to block nested .git directories before static handlers in the server configuration and to update active server rules.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-527 | Exposure of Version-Control Repository to an Unauthorized Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav | <= 2.1.2 (semver) <= 2.1.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |