CVE-2026-109326 Grav before 2.1.7 Information Disclosure via Nested .git Directories

Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructi...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the handling of organization names containing path traversal sequences. An attacker can execute arbitrary code on the server by creating nested Git repositories that overwrite another repository's hooks...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the handling of organization names containing path traversal sequences. An attacker can execute arbitrary code on the server by creating nested Git repositories that overwrite another repository's hooks...

Arbitrary Code Execution

GitHub Copilot CLI is vulnerable to Arbitrary Code Execution. The vulnerability is due to unsafe handling of Git repository configuration during repository discovery, where a malicious nested bare Git repository can define executable configuration options that are automatically invoked during Git...