CVE-2026-84149
CriticalCVSS 9.2Summary
This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated attacker could retrieve repository metadata and files, potentially reconstructing the application's source code.
Risk Assessment
Exposure of source code could allow attackers to find other vulnerabilities or hidden data, increasing security risk.
Recommendation
Remove or block access to the .git directory on production servers and conduct regular security audits.
Other vulnerabilities in ERP system
See all- CVE-2026-84148Critical
This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated attacker could manipulate parameters, leading to exposure of sensitive information of other users.
- CVE-2026-84147Critical
This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint. An unauthenticated attacker could upload arbitrary files to a web accessible directory, potentially executing arbitrary code and compromising the system.
Original NVD description (English source)
This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files, which could allow reconstruction of the application's source code.