CVE-2026-109326

7.5 HIGHpublic exploit available

Published 2026-10-12 · Updated 2026-10-12

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-527

Public exploit & PoC references

https://github.com/getgrav/grav/security/advisories/GHSA-5vx9-x8f2-f55w

All references

https://github.com/getgrav/grav/security/advisories/GHSA-5vx9-x8f2-f55w
https://www.vulncheck.com/advisories/grav-before-2.1.7-information-disclosure-via-nested-git-directories

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.