CWE-527
Exposure of Version-Control Repository to an Unauthorized Control Sphere
Monthly
Information disclosure in Grav CMS before 2.1.7 lets unauthenticated remote attackers retrieve Git metadata from nested repositories - for example /user/.git/ - exposing git config, refs, and object files that can be used to reconstruct unpublished history or recover committed secrets. The flaw exists because the web-server configurations bundled with Grav for nginx, lighttpd, IIS, and Caddy 2 block dot-prefixed paths such as .git only at the document root, so repositories created below the root (a version-controlled user/ directory, or git-installed plugins and themes) remain web-readable. No authentication or user interaction is required; no public exploit code or confirmed active exploitation was identified at time of analysis, and real-world impact is gated by the deployment precondition that a web-reachable nested Git repository actually exists and contains private history or sensitive commits. The vendor advisory (GHSA-5vx9-x8f2-f55w) points to the 2.1.7 release as the fix.
Source code disclosure in Manacle Technologies' Multi-Tenant ERP System allows unauthenticated remote attackers to reconstruct the application's source by downloading an exposed, web-accessible .git directory (CWE-527). Because the version-control metadata can be walked to recover full repository history, attackers can harvest hardcoded credentials, API keys, database schemas, and business logic that enable follow-on attacks. No public exploit or CISA KEV listing exists at this time, but .git exposure is trivially exploited with widely available off-the-shelf tooling.
`projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `eslint`, `jest`, and more, from a. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Information disclosure in Grav CMS before 2.1.7 lets unauthenticated remote attackers retrieve Git metadata from nested repositories - for example /user/.git/ - exposing git config, refs, and object files that can be used to reconstruct unpublished history or recover committed secrets. The flaw exists because the web-server configurations bundled with Grav for nginx, lighttpd, IIS, and Caddy 2 block dot-prefixed paths such as .git only at the document root, so repositories created below the root (a version-controlled user/ directory, or git-installed plugins and themes) remain web-readable. No authentication or user interaction is required; no public exploit code or confirmed active exploitation was identified at time of analysis, and real-world impact is gated by the deployment precondition that a web-reachable nested Git repository actually exists and contains private history or sensitive commits. The vendor advisory (GHSA-5vx9-x8f2-f55w) points to the 2.1.7 release as the fix.
Source code disclosure in Manacle Technologies' Multi-Tenant ERP System allows unauthenticated remote attackers to reconstruct the application's source by downloading an exposed, web-accessible .git directory (CWE-527). Because the version-control metadata can be walked to recover full repository history, attackers can harvest hardcoded credentials, API keys, database schemas, and business logic that enable follow-on attacks. No public exploit or CISA KEV listing exists at this time, but .git exposure is trivially exploited with widely available off-the-shelf tooling.
`projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `eslint`, `jest`, and more, from a. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.