CVE-2026-109326: Grav before 2.1.7 Information Disclosure via Nested .git Directories

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-12 · updated 2026-10-18
Weakness: CWE-527

Description

Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.

Affected products

getgrav grav: before 2.1.7 — fixed in 2.1.7

How to fix

Upgrade to a fixed version: getgrav grav 2.1.7. Check the vendor advisory for mitigations.

References

https://github.com/getgrav/grav/security/advisories/GHSA-5vx9-x8f2-f55w
https://www.vulncheck.com/advisories/grav-before-2.1.7-information-disclosure-via-nested-git-directories

Get alerted when CVE-2026-109326 or the next vulnerability affects your stack