CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere
Filter
The product stores a CVS, git, or other source-control repository in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
What the weakness is: CWE-527 at MITRE. All weaknesses
Ask an AI about CWE-527
Show the prompt
Explain CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/527.html and https://cve.bz/cve/cwe/527?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 8.7CVE-2026-109326EPSS 0.3%
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.g…
- 9.2CVE-2026-84149EPSS 0.5%
This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory…
- 6.5CVE-2022-20931EPSS 0.3%
A vulnerability in the version control of Cisco TelePresence CE Software for Cisco Touch 10 Devices could allow an unauthenticated, adjacent attacker to install an older version of the software on an affected device. This vulner…
- 8.1CVE-2021-21423EPSS 1.4%
`projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `eslint`, `jest`, and more, from a well-typed definition written in JavaScript. Use…