Grav CMS: Information disclosure via nested .git directories
Summary
Grav before 2.1.7 ships web server configurations that block access to .git folders only at the document root. An unauthenticated remote attacker can request nested repositories such as user/.git and retrieve Git config, refs and objects. This can reconstruct unpublished history or committed secrets. The advisory states that Apache is not affected, while nginx, lighttpd, IIS and Caddy 2 configurations are.
Affected
- Grav versions before 2.1.7 (CVE record: 0 to < 2.1.7)
- Vendor advisory sidebar lists <= 2.1.2, while the advisory text names releases through 2.1.6 and maintenance release 1.7.53.2 as affected
- Affected server configurations: nginx, lighttpd, IIS and Caddy 2 (Apache is not affected per the advisory)
Fixed in
- Grav 2.1.7 (per CVE record; not yet confirmed in vendor release notes)
- Vendor advisory sidebar lists 2.1.3 as patched; this value is considered possibly stale
- Fix for maintenance branch 1.7.x: Unknown
Workaround
- Configure the web server to deny any request path containing a .git segment at any depth, before static file handlers
- Check the live server configuration, not only the Grav package example files, as copied configurations may not be updated automatically
- Remove .git folders from the web root if they are not needed
Exploitation
- Known exploited: No (per current sources)
- CISA KEV: not listed
- Public proof of concept: none found
- EPSS: 0.00349 (low)
- CISA SSVC: exploitation none, automatable yes, technical impact partial
Our recommendation
- Update Grav to version 2.1.7 or later once the release is confirmed, and check the vendor release notes for maintenance branches
- Verify the active web server configuration and block nested .git paths at any depth
- Test that requests to nested .git paths return no content
- Check whether any site directory is a Git working copy inside the web root, especially with Git-based deployment or sync
- Review repositories for exposed credentials and rotate any secrets that may have been committed
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5vx9-x8f2-f55w github.com
- VulnCheck advisory: Grav before 2.1.7 Information Disclosure via Nested .git Directories www.vulncheck.com
- OpenCVE CVE-2026-109326 app.opencve.io
- Vulners NVD:CVE-2026-109326 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:46.
Original description (NVD)
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.