CVE-2026-109326 getgrav CVE debrief

Who should care

Defenders responsible for Grav installations, particularly those using versions prior to 2.1.7, should assess their exposure and take steps to mitigate the vulnerability. This includes verifying the version of Grav in use, reviewing server configurations, and monitoring for suspicious activity.

Why it matters

CVE-2026-109326 is a high-severity information disclosure vulnerability in Grav before 2.1.7. Unauthenticated attackers can exploit this vulnerability to access sensitive information in nested .git directories. Defenders should prioritize verifying Grav installations, reviewing configurations, and monitoring for suspicious activity.

• Potential unauthorized access to sensitive information in Git repositories
• Possible reconstruction of unpublished or committed secrets
• Increased risk of targeted attacks using disclosed information
• Need for verification of Grav version and configuration

Technical summary

Grav before 2.1.7 contains an information disclosure vulnerability due to bundled web server configurations that only block .git directories at the document root level. Unauthenticated attackers can access nested .git directories, such as user/.git, to retrieve Git configuration, references, and objects, potentially reconstructing unpublished history or accessing committed secrets. The vulnerability has a CVSS score of 8.7, indicating high severity. Defenders should prioritize verifying Grav installations for version 2.1.7 or later, reviewing configurations for proper .git directory blocking, and monitoring for unauthorized repository access attempts.

Defensive priority

Defenders should prioritize verifying Grav installations for version 2.1.7 or later, reviewing configurations for proper .git directory blocking, and monitoring for unauthorized repository access attempts.

Recommended defensive actions

• Verify Grav installations for version 2.1.7 or later
• Review configurations for proper .git directory blocking
• Monitor for unauthorized repository access attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the information disclosure vulnerability in Grav before 2.1.7, including the affected versions and potential attack vectors. Evidence is limited to public sources and CVE metadata. Defenders should verify Grav installations for version 2.1.7 or later, review configurations for proper .git directory blocking, and monitor for unauthorized repository access attempts. The information disclosure vulnerability allows attackers to retrieve Git configuration, references, and objects from .git,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.