EUVD-2026-97628
GHSA-7mh9-rw55-r7vq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Grav site with bundled web config
-
ExploitRequest nested repo path /user/.git/config
-
ExecutionEnumerate and download refs and objects
-
ImpactReconstruct Git history and extract committed secrets
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires (1) a Grav instance before 2.1.7 served using one of the vendor-bundled nginx, lighttpd, IIS, or Caddy 2 configurations, which deny access to .git only at the document root and not in subdirectories, and (2) an actual nested Git repository present and web-reachable below the root - for example a version-controlled user/ directory or git-installed plugins/themes at paths like /user/.git/. The key limiting factor is that no sensitive data is disclosed unless such a nested repository exists and contains private history or committed secrets; custom or hardened web-server configs that deny .git recursively are not affected. No authentication or user interaction is required (PR:N/UI:N). |
| Impact | This is a credible, actionable priority rather than an inflated high-CVSS issue, though its real-world impact is gated by a deployment precondition. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H) describes network-reachable, low-complexity, unauthenticated exploitation yielding high confidentiality impact (score 8.7), which is internally consistent with the description of a web-facing information disclosure flaw. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active exploitation or weaponization - exploitation status is therefore 'no public exploit identified at time of analysis.' The signals do not conflict, but note that the high score assumes a sensitive Git repository actually exists below the document root and contains secrets or unpublished history; where no nested repository is present, real-world confidentiality impact drops to negligible despite the unchanged CVSS. The flaw is confirmed via the vendor's own GitHub Security Advisory (GHSA-5vx9-x8f2-f55w) and VulnCheck, lending high confidence to its existence and the 2.1.7 fix boundary. CWE-527 (exposure of a version-control repository) matches the described behavior exactly. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a Grav site (before 2.1.7) served by one of the bundled nginx, lighttpd, IIS, or Caddy 2 configurations, which only deny access to .git at the document root. The attacker requests a nested path such as /user/.git/config and then walks refs and objects to download the repository contents, reconstructing unpublished commit history or secrets (credentials, API keys) committed to version control. No POC was provided, but the attack requires only ordinary HTTP GET requests and no special tooling beyond standard git-dumping utilities. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Information disclosure in Grav CMS before 2.1.7 lets unauthenticated remote attackers retrieve Git metadata from nested repositories - for example /user/.git/ - exposing git config, refs, and object files that can be used to reconstruct unpublished history or recover committed secrets. The flaw exists because the web-server configurations bundled with Grav for nginx, lighttpd, IIS, and Caddy 2 block dot-prefixed paths such as .git only at the document root, so repositories created below the root (a version-controlled user/ directory, or git-installed plugins and themes) remain web-readable. No authentication or user interaction is required; no public exploit code or confirmed active exploitation was identified at time of analysis, and real-world impact is gated by the deployment precondition that a web-reachable nested Git repository actually exists and contains private history or sensitive commits. The vendor advisory (GHSA-5vx9-x8f2-f55w) points to the 2.1.7 release as the fix.
RemediationAI
Vendor-released patch: upgrade to Grav 2.1.7, which corrects the bundled nginx, lighttpd, IIS, and Caddy 2 configurations; the fix is announced in vendor advisory https://github.com/getgrav/grav/security/advisories/GHSA-5vx9-x8f2-f55w. Where an immediate upgrade is not possible, apply the specific compensating controls in order of effectiveness. First, make the dotfile deny rule recursive rather than root-anchored: in nginx replace the root-scoped rule with a global location ~ /\.(?!well-known/) { deny all; } (or an equivalent location ~* /\.git { deny all; } evaluated before the root location) - note this also blocks other legitimate dotfiles such as .well-known for ACME challenges unless explicitly exempted. In IIS, extend the request-filtering hidden-segments or file-extension rules to apply at every level rather than the site root. In Caddy 2, use a path matcher covering */.git/* in addition to the root, and in lighttpd add a recursive $HTTP["url"] =~ "(^|/)\.git" deny block. Second, remove the attack surface entirely by deleting nested .git directories from the webroot after moving them outside the served tree (for example to /var/lib/gitrepos) - the trade-off is loss of in-place version control, so keep a copy or use a deployment workflow that ships releases without Git metadata. Third, where feasible, relocate the Grav user/ directory outside the document root and symlink or configure the path, which neutralizes every nested repository beneath it at once. Detection guidance: search web access logs for requests containing /.git/, /.git/config, or /.git/HEAD, and treat any hits as potential credential exposure requiring review of repository history for committed secrets and rotation of anything found.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause falls under CWE-527, exposure of version control data: the application's own hardened deployment artifacts are incomplete. Grav publishes recommended web-server configuration snippets for nginx, lighttpd, IIS, and Caddy 2 that deny access to dotfiles like .git, but those rules were anchored to the document root only. In directory-scoped server syntax (an nginx location ~ /\.git inside the root location, an IIS request-filtering rule scoped to the site root, or a Caddy file matcher limited to the root path), the deny rule does not inherit downward into subdirectories, so requests such as /user/.git/config, /user/.git/HEAD, or /user/.git/objects/... are served as ordinary static files. Grav is a flat-file PHP CMS whose user/ tree is commonly kept under version control, and plugins and themes are frequently deployed by cloning their Git repositories directly beneath the webroot - the exact layout that produces an exploitable nested .git directory. Retrieval of git config, refs, packed objects, and loose object files is sufficient to clone or reconstruct repository state offline, including commits and secrets that were never publicly released. The reported CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, score 8.7) reflects high confidentiality impact on the vulnerable component with no integrity or availability effect; an independent assessment scoring the same issue under CVSS 3.1 arrives at AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5), preserving the same unauthenticated, no-user-interaction, confidentiality-only profile. Both vectors agree that PR:N applies, so this is remotely exploitable without credentials; the limiting factor is not attacker capability but whether a nested repository is present and reachable. The CPE cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* confirms the affected product line is Grav itself in all versions below the fixed release, independent of the underlying web server, since the exposed data is static content served by whichever server the operator chose.
Know when Grav gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Remote unauthenticated HTTP requests retrieve repository contents (AV:N/AC:L/PR:N/UI:N) for a high confidentiality loss; no integrity or availability impact and no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.
Articles & Coverage 2
Executive ViewAI
Grav CMS versions before 2.1.7 can expose sensitive Git metadata from nested repositories under the web root, potentially allowing attackers to recover unpublished source code, configuration, and committed secrets. This affects organizations that host Grav with web-reachable nested Git repositories, a deployment pattern that can turn routine version control artifacts into a serious confidentiality risk. No public exploit identified at time of analysis, but the high severity and potential for secret exposure warrant immediate remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Server-side template injection (SSTI) in Grav (getgrav/grav) prior to 1.8.0-beta.27 allows an authenticated attacker hol
Broken access control in Grav CMS (CWE-285) before 1.8.0-beta.27 lets an authenticated editor-level user escalate their
A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plug
Grav is a file-based Web platform. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low a
GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full serv
Remote code execution in Grav CMS 2.0.4 (fixed in 2.0.7) lets an authenticated user holding the admin.pages or api.pages
Remote code execution in Grav CMS before 2.0.15 allows attackers holding page-edit or blueprint-config privileges to wri
Vertical privilege escalation in Grav CMS before 2.0.14 lets a delegated administrator holding only the admin.users perm
Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past
Server-side request forgery (SSRF) in Grav CMS versions prior to 1.7.49.5 allows remote authenticated attackers to make
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (S
Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary
Exploit-DB