Skip to main content

GitHub Enterprise Server CVE-2026-15343

| EUVDEUVD-2026-45189 HIGH
Path Traversal (CWE-22)
2026-07-17 GitHub_P
RCE Path Traversal Enterprise Server
8.6
CVSS 4.0 · Vendor: GitHub_P
Share

Severity by source

Vendor (GitHub_P) PRIMARY
8.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.2 HIGH

Multi-step prerequisites (container code execution, symlink setup, specific repo config) justify AC:H; PR:L for an authenticated updater context; S:C as the file write escalates into secret-bearing workflow execution.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_P).

CVSS VectorVendor: GitHub_P

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 17, 2026 - 16:15 vuln.today
CVE Published
Jul 17, 2026 - 15:18 cve.org
HIGH 8.6

DescriptionCVE.org

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files under .github/workflows/ as the path validation did not check the effective path which the attacker could control through the dependency file's directory and symlink target. If the repository used a pull_request_target workflow or had auto-merge enabled, an injected workflow could execute with access to the repository's GitHub Actions secrets. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.3, 3.20.5, 3.19.9, 3.18.12, 3.17.18.

AnalysisAI

Arbitrary file write in GitHub Enterprise Server (all releases before 3.22) lets an attacker who already has code execution inside the Dependabot updater container escape the intended dependency-file directory via path traversal and symlink manipulation, planting attacker-controlled files anywhere in a repository - including GitHub Actions workflows under .github/workflows/. Because path validation checked the declared rather than the effective (symlink-resolved) path, an injected workflow can run with the repository's Actions secrets when the repo uses pull_request_target or auto-merge. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Gain code execution in Dependabot updater container
Delivery
Craft dependency dir and symlink target
Exploit
Bypass effective-path validation
Install
Write malicious .github/workflows file
C2
pull_request_target/auto-merge runs workflow
Execute
Execute with repo Actions secrets
Impact
Exfiltrate secrets
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the attacker already achieve code execution inside the Dependabot updater container, and that they control both a dependency file's directory path and a symlink target used during the update write-back. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H) scores 8.6 and models high confidentiality and integrity impact from a network-reachable, low-privilege position with no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker gains code execution inside the Dependabot updater container (for example by poisoning a dependency-resolution step) targeting a repository that has auto-merge or pull_request_target enabled. Using a crafted dependency-file directory and a symlink whose target escapes path validation, they write a malicious workflow to .github/workflows/. …
Remediation Vendor-released patch: upgrade GitHub Enterprise Server to the fixed release on your maintenance track - 3.21.3, 3.20.5, 3.19.9, 3.18.12, or 3.17.18 (versions 3.22 and later are unaffected). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all GitHub Enterprise Server instances and identify those running releases prior to version 3.22, then disable auto-merge features across all repositories and restrict pull_request_target workflows to administrators only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Enterprise Server

View all
CVE-2013-4854 HIGH POC
7.8 Jul 29

The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and

CVE-2024-0200 CRITICAL POC
9.8 Jan 16

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. R
CVE-2024-9487 CRITICAL POC
9.5 Oct 10

An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowe
CVE-2024-4985 CRITICAL
10.0 May 20

An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sig
CVE-2017-7420 CRITICAL
9.8 Aug 21

An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Ent
CVE-2023-4501 CRITICAL
9.8 Sep 12

User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL

CVE-2022-46255 CRITICAL
9.8 Dec 14

An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server

CVE-2021-22869 CRITICAL
9.8 Sep 24

An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted

CVE-2024-6800 CRITICAL
9.5 Aug 20

An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication wi
CVE-2026-9312 CRITICAL
9.2 May 27

Server-side request forgery in GitHub Enterprise Server lets an unauthenticated attacker coerce the appliance into issui
CVE-2024-1378 CRITICAL
9.1 Feb 13

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor rol
CVE-2024-1374 CRITICAL
9.1 Feb 13

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor rol

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2018-13379 CRITICAL POC
9.1
CVE-2015-0016 HIGH POC
7.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2026-15343 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy