External risk intelligence

ERP System Source Code Exposure via Public .git Directory

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-84149

The vulnerability involves a publicly accessible .git directory on a web-based ERP system. Web applications and their associated web servers are commonly deployed as internet-facing services, making the accidental exposure of sensitive repository files through a public web root a common occurrence for externally reachable web endpoints.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in an ERP system allows unauthenticated remote attackers to access a publicly exposed `.git` directory. This exposure could lead to the reconstruction of the application's source code, posing a significant risk.

Source code may be exposed publicly.
Protects against intellectual property theft.
Confirm system relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could begin by identifying a web-facing ERP system with a publicly accessible .git directory. By navigating to this exposed directory, the attacker can obtain repository metadata and files. This information could then be used to reconstruct the application's source code, potentially revealing further vulnerabilities or sensitive information.

Publicly accessible .git directory
Accessing exposed repository metadata
Source code reconstruction risk

Live Threat

Current exploitation, exposure, and threat context

A publicly accessible .git directory in an ERP system could allow an unauthenticated remote attacker to retrieve repository metadata and associated files, potentially enabling the reconstruction of the application's source code.

Application source code.
Unauthenticated remote access.
Source code reconstruction.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ERP system owner, likely a platform or application team, is responsible for securing the codebase and its deployment. The first step is to identify all instances of the ERP system, confirm public reachability, and determine business criticality. This will help prioritize remediation efforts and assign the issue to the accountable owner.

ERP system owners must be identified.
Confirm public exposure and business criticality.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ERP system affected by CVE-2026-84149?

This ERP system is a web-based enterprise resource planning platform used to manage core business processes. It stores sensitive organizational data and logic. The vulnerability stems from how the web server deployment is configured, specifically involving the accidental inclusion of version control metadata in the publicly reachable web directory.

How does CVE-2026-84149 work?

This issue is classified under CWE-527, which relates to the exposure of hidden or sensitive directories. In this case, a .git directory—normally used for tracking changes during software development—was left accessible via the web. Because this folder contains the history and files of the application, an unauthorized person can download it to piece together the site's original source code.

Does any specific action trigger this vulnerability?

The vulnerability is triggered simply by an attacker requesting files from the .git directory over the network. It does not require special software or complex interactions. Importantly, the vulnerability exists because the directory is publicly reachable; if the directory is blocked by server permissions or is not hosted within the web-accessible root path, the files cannot be retrieved.

Is my system at risk?

Halo Surface Signal indicates that because this ERP software is a web-based service, it is often deployed to be internet-facing, making this a relevant concern for many organizations. If your instance is reachable from the internet, it is at higher risk of being discovered and accessed by external parties compared to systems restricted to internal-only networks.

How should I respond to CVE-2026-84149?

Begin by auditing your web server configurations to confirm if a .git directory is reachable from the internet. If you identify this file structure in your public web root, remove the directory immediately. You should then coordinate with your application or platform teams to ensure that deployment pipelines are updated to exclude version control files from production environments.

References

www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.