7.5Yüksek
CVE-2026-109326Grav before 2.1.7 Information Disclosure via Nested .git Directories
Açıklama
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.
Zayıflık türü (CWE):
CWE-527
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-5vx9-x8f2-f55w) vendor-advisory
- VulnCheck Advisory: Grav before 2.1.7 Information Disclosure via Nested .git Directories third-party-advisory