CVE-2026-84149

CVE-2026-84149 is a source code disclosure flaw in an ERP system caused by a publicly accessible .git directory left in the deployed application. An unauthenticated remote attacker can trigger it simply by requesting the exposed .git directory over the network, with no privileges or user interaction required. The attacker gains access to repository metadata and associated files, which is enough to reconstruct the application's source code; the CVSS 4.0 vector rates subsequent-system confidentiality impact as high, consistent with disclosed source potentially revealing further sensitive information. Any organization running the affected ERP system with its .git directory reachable from the network is affected, though the vendor name and version ranges are not specified in the available data. Exploitation has not been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Check whether the ERP deployment serves its .git directory over HTTP/HTTPS (e.g., a request to /.git/HEAD returning repository data) and block access to it at the web server or reverse proxy level, or remove the repository from the production web root. Apply the vendor's fix as soon as an update is identified, since the advisory data does not specify patched versions. Assume any source in the exposed repository was readable by outsiders, and review committed files and history for embedded credentials or API keys, rotating anything found.