What CVEs are caused by CWE-527?

4 recorded CVEs are attributed to CWE-527, including CVE-2026-84149, CVE-2026-109326, CVE-2021-21423.

What are the consequences of CWE-527?

Exploiting CWE-527 can lead to: Read Application Data, Read Files or Directories.

Is CWE-527 actively exploited?

4 recorded CVEs are caused by CWE-527; none are currently in CISA's KEV catalog of actively exploited flaws.

RadicalNotion.AI

Log in Create an account

Variant weakness

Incomplete

CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere

The product stores a CVS, git, or other repository in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.

Last updated May 1, 2026

4

Recorded CVEs

With this primary weakness

0

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Variant

Abstraction

MITRE classification

Overview

Version control repositories such as CVS or git store version-specific metadata and other details within subdirectories. If these subdirectories are stored on a web server or added to an archive, then these could be used by an attacker. This information may include usernames, filenames, path root, IP addresses, and detailed "diff" data about how files have been changed - which could reveal source code snippets that were never intended to be made public.

Real-world CVEs

4 recorded CVEs are caused by CWE-527 (Exposure of Version-Control Repository to an Unauthorized Control Sphere). The highest-severity and most recent are shown first. 2 new CWE-527 CVEs have been recorded so far in 2026.

High · CVSS 7.6 · EPSS 72th

2021-04-06

CVE-2022-20931

Medium · CVSS 6.5 · EPSS 18th

2024-11-15

Common consequences

What can happen when CWE-527 is exploited.

Read Application Data, Read Files or Directories

Affects: Confidentiality

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Operation

Applies to

Technologies

Web Based

How to prevent it

Practical mitigations for CWE-527, grouped by where in the lifecycle they apply.

Operation

Distribution

System Configuration

Recommendations include removing any CVS directories and repositories from the production server, disabling the use of remote CVS repositories, and ensuring that the latest CVS patches and version updates have been performed.

Frequently asked questions

Common questions about CWE-527.

What is CWE-527?: The product stores a CVS, git, or other repository in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
What CVEs are caused by CWE-527?: 4 recorded CVEs are attributed to CWE-527, including CVE-2026-84149, CVE-2026-109326, CVE-2021-21423.
How do you prevent CWE-527?: Recommendations include removing any CVS directories and repositories from the production server, disabling the use of remote CVS repositories, and ensuring that the latest CVS patches and version updates have been performed.
What are the consequences of CWE-527?: Exploiting CWE-527 can lead to: Read Application Data, Read Files or Directories.
Is CWE-527 actively exploited?: 4 recorded CVEs are caused by CWE-527; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Track CWE-527 CVEs

Get an alert when a new CWE-527 CVE affects your products, with AI-written analysis and remediation steps.

Create an account See pricing