CVE-2026-109326
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Oct 12, 2026
Vendor
unknown
Description
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.