CVE-2026-84149
Deferred Deferred - Pending Action

ERP System Source Code Exposure via Exposed .git Directory

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Indian Computer Emergency Response Team (CERT-In)

Description
This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files, which could allow reconstruction of the application's source code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84149
EUVD
EUVD-2026-69059

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-527 The product stores a CVS, git, or other repository in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in an ERP system where a .git directory is publicly accessible. An attacker can access this directory without authentication to retrieve repository metadata and files, potentially reconstructing the application's source code.

Detection Guidance

Check for exposed .git directories by accessing URLs like http://example.com/.git/ or http://example.com/path/.git/. Use commands like curl -I http://<target>/.git/ or wget --spider http://<target>/.git/ to verify access. Also inspect web server logs for repeated requests to .git paths.

Impact Analysis

An attacker could exploit this to obtain sensitive application code, leading to further attacks like data breaches, unauthorized access, or intellectual property theft. The high CVSS score (9.2) indicates severe impact.

Compliance Impact

Exposure of source code may violate GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access to sensitive data or systems, risking non-compliance and legal penalties.

Mitigation Strategies

Remove public access to the .git directory by configuring the web server to deny access to .git folders. For Apache, add "RedirectMatch 404 /\.git" to .htaccess or server config. For Nginx, use location ~ /\.git { deny all; } in server block.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84149. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart