CVE-2026-109326 in Grav
Summary
by MITRE • 10/12/2026
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Grav versions prior to 2.1.7 stems from an incomplete implementation of security configurations for web servers that are bundled with the content management system. Specifically, the configuration files provided for nginx, lighttpd, IIS, and Caddy 2 were designed to block access to .git directories at the document root level only. This oversight creates a significant information disclosure vulnerability because it fails to recursively apply these restrictions to nested subdirectories within the web root. As a result, any Git repository located in a subdirectory remains accessible via HTTP requests if the specific path is known or guessed by an attacker.
Unauthenticated attackers can exploit this misconfiguration by directly requesting paths such as user/.git or other nested locations where .git directories might exist. By accessing these endpoints, adversaries can retrieve critical version control metadata including Git configuration files, references to branches and tags, and raw object data stored within the repository. This access allows for the reconstruction of unpublished commit history, which may contain sensitive architectural details, internal logic, or development notes that were never intended for public consumption. Furthermore, if developers have accidentally committed secrets such as API keys, database credentials, or private cryptographic keys into any version of the codebase, these artifacts become readily available to anyone with network access to the vulnerable server.
The operational impact of this vulnerability is severe, primarily due to its potential role in facilitating further attacks through credential theft and reconnaissance. The exposure of unpublished history can reveal internal workflows, pending features, or known bugs that attackers could leverage for targeted exploits. More critically, the retrieval of committed secrets provides immediate footholds into backend systems, databases, or third-party services integrated with the Grav installation. This aligns with CWE-200, which classifies this issue as an Information Exposure vulnerability, and maps to MITRE ATT&CK techniques related to Discovery and Credential Access, specifically those involving file directory enumeration and extraction of sensitive information from version control systems.
To mitigate this risk, administrators must ensure that all web server configurations provided with Grav are updated to recursively block access to .git directories across the entire document root structure, not just at the top level. This involves modifying configuration rules in nginx, lighttpd, IIS, and Caddy 2 to match any path segment containing .git rather than restricting it solely to the root directory. Additionally, organizations should audit their repositories for accidentally committed secrets using automated scanning tools before deployment. Implementing strict access controls on version control systems and ensuring that production environments do not contain full Git history are also essential preventive measures against this class of vulnerability.