CWE-540Inclusion of Sensitive Information in Source Code

Abstraction: Base · CVEs in our corpus: 37

Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.

There are situations where it is critical to remove source code from an area or server. For example, obtaining Perl source code on a system allows an attacker to understand the logic of the script and extract extremely useful information such as code bugs or logins and passwords.

Last updated: 14 October 2026 20:41 UTC

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

IR-9 Information Spillage Response
SA-21 Developer Screening
SC-38 Operations Security
PR.PS-06

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (3)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
`IR-9`	Information Spillage Response	IR	Detection and removal of spilled information addresses cases where sensitive data was included in source code.
`SA-21`	Developer Screening	SA	Screening helps prevent intentional insertion of sensitive information into source code by untrusted developers.
`SC-38`	Operations Security	SC	Prevents inclusion of sensitive information in source code and development artifacts through SDLC-wide OPSEC controls.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2026-84390`	7.3	9.8	0.0052	2026-09-11
`CVE-2025-26013`	6.2	8.2	0.0042	2025-02-21
`CVE-2024-38647`	5.9	7.5	0.0065	2024-11-22
`CVE-2025-49182`	5.9	7.5	0.0055	2025-06-12
`CVE-2026-4155`	5.9	7.5	0.0068	2026-04-11
`CVE-2024-1272`	5.8	7.5	0.0039	2024-06-05
`CVE-2026-45728`	5.8	7.5	0.0042	2026-05-26
`CVE-2021-28805`	5.7	7.8	0.0024	2021-06-11
`CVE-2026-73591`	5.7	7.5	0.0026	2026-09-23
`CVE-2023-39250`	5.6	7.8	0.0013	2023-08-16
`CVE-2026-103096`	5.6	7.5	0.0015	2026-10-02
`CVE-2026-103097`	5.6	7.5	0.0015	2026-10-02
`CVE-2021-34638`	5.4	6.5	0.0133	2021-08-05
`CVE-2026-35383`	5.2	6.5	0.0048	2026-04-02
`CVE-2024-38327`	5.1	6.8	0.0033	2025-07-10
`CVE-2023-23448`	4.6	5.3	0.0079	2023-05-15
`CVE-2023-30802`	4.6	5.3	0.0081	2023-10-10
`CVE-2024-2265`	4.6	5.3	0.0083	2024-03-07
`CVE-2024-35144`	4.4	5.3	0.0031	2025-01-25
`CVE-2025-0923`	4.4	5.3	0.0028	2025-06-11
`CVE-2026-16581`	4.4	5.3	0.0038	2026-07-28
`CVE-2021-34744`	4.1	4.9	0.0075	2021-10-06
`CVE-2021-34757`	4.1	4.9	0.0062	2021-10-06
`CVE-2021-1516`	3.9	4.3	0.0100	2021-05-06
`CVE-2024-39729`	3.7	4.3	0.0041	2024-07-15