CVE-2026-109326: Grav information disclosure via nested Git repositories

CVE-2026-109326 · Severity: high · CVSS 7.5 · Published 2026-10-12

Grav is a flat-file content management system used to build websites. Bundled web server configurations (nginx, lighttpd, IIS, Caddy 2) fail to block access to .git directories nested in subdirectories, allowing unauthenticated attackers to download Git history, configuration, and potentially exposed secrets without authentication.

Technologies: Grav. Vendors: Grav.

Quick answers

Is CVE-2026-109326 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-109326 being exploited in the wild.
How severe is CVE-2026-109326?
High severity, with a CVSS score of 7.5, published 12 October 2026.
Which products and versions are affected?
Grav before 2.1.7.
Is there a fix for CVE-2026-109326?
Yes: fixed in 2.1.7. Until then: Update bundled server configurations to block .git directories at all depths, not only at the document root. Operators who have copied active server configurations should manually update their rules to match the patched versions and remove any accessible Git repositories from web-served directories. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109326 attacked?
It is attacked over the network.
Am I affected by CVE-2026-109326?
Check whether you run Grav at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 2.1.7

Update bundled server configurations to block .git directories at all depths, not only at the document root. Operators who have copied active server configurations should manually update their rules to match the patched versions and remove any accessible Git repositories from web-served directories.

Technical details

The vulnerability exists because bundled server configurations only block .git access at the document root, not in nested paths such as user/.git. Attackers can request these nested repositories via HTTP GET to retrieve Git objects, refs, and configuration files. This is a directory traversal class issue affecting nginx, lighttpd, IIS, and Caddy 2 configurations shipped with Grav; Apache configurations are not affected as they already match dotted segments at any depth.

Affected products

  • Grav Grav before 2.1.7

Timeline

  • 2026-09-23: disclosed: GitHub Security Advisory GHSA-5vx9-x8f2-f55w published
  • 2026-10-12: advisory: CVE-2026-109326 assigned and published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.