CVE-2026-109326 (CVSS 7.5)

Description

Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.

Is your site exposed to CVE-2026-109326?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploit Prediction

0.0035

Probability of exploitation

0.27%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-527 CWE-527

References

Other References

https://github.com/getgrav/grav/security/advisories/GHSA-5vx9-x8f2-f55w https://www.vulncheck.com/advisories/grav-before-2.1.7-information-disclosure-via-nested-git-directories

Frequently Asked Questions

What is CVE-2026-109326? +

Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2026-109326? +

CVE-2026-109326 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0035, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-109326? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-84149

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An …

CVE-2022-20931 6.5

A vulnerability in the version control of Cisco TelePresence CE Software for Cisco Touch 10 Devices could allow an unauthenticated, adjacent attacker …

CVE-2026-109326