Is CVE-2026-109326 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109326?

CVE-2026-109326 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-109326

Description

Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.