CVE-2026-109326: Grav before 2.1.7 Information Disclosure via Nested .git Directories

Q: Which deployments are exposed to this issue?

Grav installations before 2.1.7 using the bundled nginx, lighttpd, IIS, or Caddy 2 configurations are exposed if a nested .git directory is reachable beneath the web-accessible document tree.

Q: Does exploitation require authentication or user interaction?

No. An unauthenticated remote attacker can exploit the issue by requesting files from a nested repository path such as user/.git.

Q: What information could an attacker obtain?

Attackers may retrieve Git configuration, references, and object data. This can allow reconstruction of unpublished repository history or recovery of secrets committed to the repository.

Q: What should be checked while awaiting an upgrade?

Check for nested .git directories under the web-accessible Grav document tree, particularly in user-accessible paths. Verify that the web server denies access to .git directories at any directory depth, not only at the document root.

Published Oct 12, 2026

Updated

Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.

Affected Software

1 affected component

Grav Grav<2.1.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Grav to a version that resolves this vulnerability.
Fixed in 2.1.7

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Grav installations before 2.1.7 using the bundled nginx, lighttpd, IIS, or Caddy 2 configurations are exposed if a nested .git directory is reachable beneath the web-accessible document tree.

Does exploitation require authentication or user interaction?

No. An unauthenticated remote attacker can exploit the issue by requesting files from a nested repository path such as user/.git.

What information could an attacker obtain?

Attackers may retrieve Git configuration, references, and object data. This can allow reconstruction of unpublished repository history or recovery of secrets committed to the repository.

What should be checked while awaiting an upgrade?

Check for nested .git directories under the web-accessible Grav document tree, particularly in user-accessible paths. Verify that the web server denies access to .git directories at any directory depth, not only at the document root.

CVE-2026-109326: Grav before 2.1.7 Information Disclosure via Nested .git Directories

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication or user interaction?

What information could an attacker obtain?

What should be checked while awaiting an upgrade?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication or user interaction?

What information could an attacker obtain?

What should be checked while awaiting an upgrade?