CVE-2026-109326
Deferred Deferred - Pending Action

Information Disclosure in Grav CMS via Nested Git Repositories

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109326
EUVD
EUVD-2026-97628

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-527 The product stores a CVS, git, or other repository in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Grav before version 2.1.7 has an information disclosure vulnerability due to web server configurations that only block access to .git directories at the document root. Attackers can exploit this by requesting paths like user/.git to access Git metadata, including configuration files, references, and objects. This allows reconstruction of unpublished repository history or exposure of committed secrets.

Detection Guidance

Check for exposed .git directories by sending HTTP requests to paths like /.git/config, /.git/refs, or /.git/objects/info/alternates. Use tools like curl or wget to probe nested paths such as user/.git. Inspect web server access logs for unusual requests targeting .git paths.

Impact Analysis

Unauthenticated attackers could retrieve sensitive data such as source code, API keys, or credentials stored in Git history. This may lead to further attacks like code tampering, data breaches, or unauthorized access to systems relying on exposed secrets. The impact includes loss of intellectual property and potential compliance violations.

Compliance Impact

This vulnerability could result in unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face fines, legal penalties, and reputational damage due to non-compliance with data protection regulations.

Mitigation Strategies

Upgrade Grav to version 2.1.7 or later. Review and update web server configurations to block access to any .git directories, not just at the document root. Remove or restrict access to any exposed .git folders on the server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109326. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart