CVE-2026-109326: Grav before 2.1.7 Information Disclosure via Nested .git Directories
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.1.7
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Grav installations before 2.1.7 using the bundled nginx, lighttpd, IIS, or Caddy 2 configurations are exposed if a nested .git directory is reachable beneath the web-accessible document tree.
Does exploitation require authentication or user interaction?
No. An unauthenticated remote attacker can exploit the issue by requesting files from a nested repository path such as user/.git.
What information could an attacker obtain?
Attackers may retrieve Git configuration, references, and object data. This can allow reconstruction of unpublished repository history or recovery of secrets committed to the repository.
What should be checked while awaiting an upgrade?
Check for nested .git directories under the web-accessible Grav document tree, particularly in user-accessible paths. Verify that the web server denies access to .git directories at any directory depth, not only at the document root.