EUVD-2026-69059
GHSA-mpmp-g8h4-fq2c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network fetch of the .git directory with no user interaction gives AV:N/AC:L/PR:N/UI:N; source disclosure is confidentiality-only (C:H, I:N, A:N) with no scope change (S:U).
Primary rating from Vendor (CERT-In).
CVSS VectorVendor: CERT-In
Lifecycle Timeline
2DescriptionCVE.org
This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files, which could allow reconstruction of the application's source code.
AnalysisAI
Source code disclosure in Manacle Technologies' Multi-Tenant ERP System allows unauthenticated remote attackers to reconstruct the application's source by downloading an exposed, web-accessible .git directory (CWE-527). Because the version-control metadata can be walked to recover full repository history, attackers can harvest hardcoded credentials, API keys, database schemas, and business logic that enable follow-on attacks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that the ERP web server expose the .git directory under the public web root - i.e., the application was deployed by cloning/pulling into the served directory rather than deploying built artifacts, and no server rule blocks /.git access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H) scores 9.2 and correctly captures easy, unauthenticated, network-based exploitation with no user interaction, but the SC:H (subsequent-system confidentiality) contribution that pushes it to CRITICAL is debatable for what is fundamentally an information-disclosure issue; a CVSS 3.1 mapping lands closer to 7.5 (High) with confidentiality-only impact and no integrity/availability effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version was identified at time of analysis; consult CERT-In advisory CIVN-2026-0430 (https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0430) for vendor guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately rotate all hardcoded credentials, API keys, and database passwords exposed in source code; isolate Manacle ERP instances from production networks or implement strict access controls; begin forensic analysis of access logs for unauthorized activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Multi Tenant Erp System
View allUnauthenticated remote code execution in Manacle Technologies' Multi-Tenant ERP System allows attackers to upload arbitr
Sensitive-data exposure in Manacle Technologies' Multi-Tenant ERP System allows an unauthenticated remote attacker to re
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today