CVE-2026-109326

Executive Summary

CVE-2026-109326 is an unauthenticated information disclosure vulnerability in the Grav content management system (CMS) affecting versions before 2.1.7. Ship-bundled web server configurations for nginx, lighttpd, IIS, and Caddy 2 only block access to the .git directory when it resides at the document root, allowing remote attackers to retrieve nested Git repositories (for example user/.git) and reconstruct source history or committed secrets. With a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), the flaw requires no credentials or user interaction and results in high confidentiality impact, though no public exploit or Nuclei template currently exists.

Technical Analysis

The vulnerability is an instance of CWE-527, "Exposure of Version Control Repository," a class of misconfiguration in which a web server is permitted to serve files from a .git directory tree over HTTP. Git repositories store substantial sensitive metadata in predictable locations: the configuration file (.git/config), reference pointers and packed refs (.git/refs, .git/packed-refs), the commit index (.git/index), and the object store (.git/objects), which contains blobs, trees, commits, and tags. When any of these are reachable via HTTP GET, an attacker can reconstruct source code, deleted files, and committed secrets without authentication.

The distinguishing characteristic of CVE-2026-109326 is the incomplete scope of the access-control rule. Grav ships preconfigured web server configuration samples for four distinct server products — nginx, lighttpd, IIS, and Caddy 2 — intended to deny HTTP access to the .git path. According to the NVD description, each of these bundled configurations "block .git only at document root." That means the deny rule is written to match a repository located directly under the web root (for example /.git/...) but does not match a repository in a nested subdirectory (for example /user/.git/...). Because Grav applications are commonly deployed with content and other project directories nested below the document root, an actual repository present in a nested path remains fully exposed to unauthenticated requests.

The attack surface is the HTTP listener itself. Any Grav instance running behind one of the affected bundled server configurations, with a nested .git directory present beneath the document root, is remotely reachable. No authentication, special headers, or user interaction are needed — the vulnerability is a straightforward path-scope weakness in the access-control configuration rather than a code-execution or injection flaw. This explains the CVSS subscores precisely: network vector (AV:N), low attack complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), and unchanged scope (S:U), with high confidentiality impact (C:H) because the exposed data can include secrets and unpublished history, and no integrity or availability impact (I:N/A:N).

Note that the provided intelligence does not specify the exact regular-expression or location-block syntax used by each server's sample configuration, nor the precise default deployment layout. Those details cannot be asserted without the vendor advisory; the analysis here is limited to the mechanism described in the NVD entry: root-scoped .git blocking leaves nested repositories exposed.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-109326. The following attack chain is inferred strictly from the vulnerability class (CWE-527) and the NVD description; no fictitious endpoints or code patterns are introduced.

1. Reconnaissance and target identification. An attacker enumerating internet-facing Grav sites identifies candidates by their characteristic front-end fingerprint or by probing for the well-known Git metadata paths. Because the flaw concerns nested repositories, discovery requires testing candidate subpaths (for example user/.git/) in addition to the document root, since the root path is blocked by the bundled rule. The attacker can use the Shodan queries in the Metadata section to build a target list.

2. Triggering the flaw. The attacker issues unauthenticated HTTP GET requests for Git metadata under a nested path — for example requesting the repository configuration file at user/.git/config, or the reference and object files under user/.git/refs/ and user/.git/objects/. The bundled server configuration fails to match these nested paths, so the server returns the file content instead of a denial response. A 200 OK with recognizable Git content confirms exposure.

3. Payload/execution method. This is a read-only disclosure; the "payload" is the set of crafted HTTP requests targeting the nested .git tree. At the vulnerability-class level, the attacker first retrieves .git/config and the refs to learn the repository structure, then fetches the loose and packed objects (and, where present, the index) needed to reassemble commit history and file contents. Standard Git tooling can be pointed at the mirrored metadata to reconstruct the repository client-side.

4. Post-exploitation impact. Once the repository is reconstructed, the attacker can read unpublished source code, deleted-but-committed files, and any secrets accidentally committed to history — for example API keys, database credentials, or signing material. These secrets frequently enable lateral movement or privilege escalation into adjacent systems. Because the disclosure is read-only, the attacker leaves no modification on the target; the primary detection opportunity is in web server access logs, not file-integrity monitoring.

Impact Assessment

The confidentiality impact is high (C:H). Successful exploitation yields the target's Git repository contents without authentication: configuration, references, and object data sufficient to reconstruct unpublished history or committed secrets. In real-world engagements, exposed .git trees routinely leak credentials that grant access to databases, cloud APIs, and CI/CD pipelines, so the "blast radius" can extend well beyond the CMS itself to any system whose secrets were ever committed to the affected repository.

Integrity and availability impacts are none (I:N/A:N); the attacker does not modify or disrupt the target. The scope is unchanged (S:U). The overall base score of 7.5 reflects a remotely exploitable, low-complexity, unauthenticated flaw with high data-confidentiality exposure. Affected parties are any Grav deployments before 2.1.7 that (a) use one of the bundled nginx, lighttpd, IIS, or Caddy 2 configurations and (b) contain a .git directory nested below the document root. Because CVE-2026-109326 is not in CISA KEV, there is no confirmed exploitation in the wild as of this writing, and EPSS has not yet scored it.

Detection Guidance

Sigma Rule

title: Grav Nested .git Repository Access Attempt (CVE-2026-109326)
id: 3f9a1c2e-7b4d-4e21-9c50-1a0d5e7b9c34
status: experimental
description: Detects HTTP requests for Git metadata under nested paths, exploiting incomplete .git blocking in bundled Grav web server configs.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109326
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_git:
    cs-uri-query|contains:
      - '.git/config'
      - '.git/HEAD'
      - '.git/refs/'
      - '.git/objects/'
      - '.git/index'
      - '.git/packed-refs'
  selection_nested:
    cs-uri-stem|re: '/(?!\\.git/)[^/]+/\\.git/'
  condition: selection_git and selection_nested
falsepositives:
  - Security scanners and authorized penetration tests
level: high

YARA Rule

rule CVE_2026_109326_Git_Metadata_Disclosure_Response
{
    meta:
        description = "Detects HTTP responses leaking Git repository metadata (exploitation of CVE-2026-109326)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109326"
        date = "2026-01-01"
        severity = "high"

    strings:
        $git_config = "[core]" ascii nocase
        $repoformat = "repositoryformatversion" ascii nocase
        $gitdir     = "gitdir:" ascii nocase
        $head_ref   = "ref: refs/heads/" ascii
        $pack_refs  = "# pack-refs with:" ascii

    condition:
        uint16(0) == 0x0d0a or filesize < 5MB and
        (1 of ($git_config, $repoformat, $gitdir) or 1 of ($head_ref, $pack_refs))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109326 Grav Nested .git Repository Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/\/[^\/]+\/\.git\//i"; http.uri; content:".git/"; nocase; classtype:attempted-recon; reference:cve,2026-109326; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109326; sid:2026109326; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method == "GET" and
     http.request.uri : "*/.git/config"]
  [network where http.request.method == "GET" and
     (http.request.uri : "*/.git/HEAD" or
      http.request.uri : "*/.git/refs/*" or
      http.request.uri : "*/.git/objects/*")]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=coalesce(uri, cs_uri_stem, request)
| where match(uri, "(?i)/[^/]+/\.git/(config|HEAD|refs/|objects/|index|packed-refs)")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as requested_paths by src_ip, host
| where count >= 2
| sort - count

Wazuh OSSEC Rule

<group name="web,accesslog,cve-2026-109326,">
  <rule id="100926" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/.git/config</url>
    <description>CVE-2026-109326: Grav nested .git config access attempt</description>
    <mitre>
      <id>T1592</id>
    </mitre>
  </rule>
  <rule id="100927" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <regex>\.git/(HEAD|refs/|objects/|index|packed-refs)</regex>
    <description>CVE-2026-109326: Grav nested Git metadata retrieval attempt</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version package data is confirmed in the provided intelligence. Treat all guidance below as mitigation rather than a verified vendor patch.

1. Immediate mitigations.

• Remove any .git directory from beneath the web document root entirely; deploy only exported source, not a working repository. This eliminates the exposure regardless of server configuration.
• Where a repository must remain on the host, extend the bundled access-control rules to deny .git at every directory depth, not only the document root. The core defect is that the shipped rules are scoped to a root-level .git match; broaden the deny pattern so nested paths such as user/.git/ are also blocked across nginx, lighttpd, IIS, and Caddy 2.
• Implement a global deny for dot-directories as a defense-in-depth measure, and confirm it applies recursively.
• Restrict or place the CMS behind an authenticating reverse proxy until configuration is verified.

2. Patch/upgrade steps.

• No verified patch is available from tracked sources. Monitor the Grav project for a release addressing the bundled configuration scope; the NVD description frames the fix boundary at version 2.1.7, so upgrade to a corrected release once it is published and independently verified.
• After any upgrade or config change, re-test by requesting both root-level and nested .git paths and confirming both return a denial response.

3. Long-term hardening.

• Never allow version-control metadata to be served by a production web server; add CI checks that fail a deployment if any .git directory is present under the web root.
• Adopt secret-scanning (pre-commit and CI) to prevent credentials from entering repositories in the first place, reducing the value of any future disclosure.
• Maintain and test a canonical, depth-independent deny list for sensitive paths across every server product in use, and include such path-scope checks in recurring security reviews.

References

• NVD — CVE-2026-109326: https://nvd.nist.gov/vuln/detail/CVE-2026-109326
• MITRE CWE-527 — Exposure of Version Control Repository: https://cwe.mitre.org/data/definitions/527.html
• MITRE ATT&CK T1592 — Gather Victim Host Information: https://attack.mitre.org/techniques/T1592/
• MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• Grav project (vendor site / release information): https://getgrav.org

No threat actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-109326 in the provided data. The CVE is not listed in CISA KEV, no public PoC exists, and FIRST.org has not yet assigned an EPSS score.