CVE-2026-109326: Exposure of Version-Control Repository to an Unauthorized Control Sphere in getgrav grav
Description
Grav versions before 2.1.7 have an information disclosure vulnerability where nested .git repositories can be accessed by unauthenticated attackers. This occurs because default configurations for bundled web servers block access to .git only at the document root, not in nested directories. Attackers can retrieve Git repository data such as config files, refs, and objects, potentially exposing unpublished history or committed secrets.
CVSS v4.0
Score 8.7high
Affected software
getgrav
grav
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109326 affects Grav versions prior to 2.1.7. The vulnerability arises from insufficient blocking of access to nested .git directories by default configurations of bundled web servers including nginx, lighttpd, IIS, and Caddy 2. This allows unauthenticated attackers to request nested repository paths (e.g., user/.git) and access sensitive Git data. The exposed data can include configuration files, references, and objects, enabling reconstruction of unpublished repository history or extraction of committed secrets.
Potential Impact
An unauthenticated attacker can access sensitive Git repository data from nested .git directories, leading to information disclosure. This may reveal unpublished code history or secrets committed to the repository, which could facilitate further attacks or data leakage.
Mitigation Recommendations
Upgrade Grav to version 2.1.7 or later, where this issue is fixed. The vendor advisory confirms that versions before 2.1.7 are affected and the vulnerability is addressed in 2.1.7. Until upgrading, review and adjust web server configurations to block access to all .git directories, including nested ones.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T14:15:29.012Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd0c152cdf04f656b11bfc
Added to database: 10/12/2026, 16:34:29 UTC
Last enriched: 10/12/2026, 17:03:52 UTC
Last updated: 10/12/2026, 21:46:45 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.