Vulnerability Bulletins |
CVE-2026-109326 |
|
| Affected software | NGINX |
| Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-109326 | |