Skip to main content

GitHub Enterprise Server CVE-2026-17556

| EUVDEUVD-2026-53608 HIGH
Path Traversal (CWE-22)
2026-08-05 product-cna@github.com GHSA-h3g3-4265-wv56
Path Traversal Enterprise Server
8.8
CVSS 4.0 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
8.8 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.1 CRITICAL

Network-reachable unauthenticated attack with no interaction; no confidentiality impact since the primitive is deletion only; integrity and availability both high due to recursive filesystem destruction.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 05, 2026 - 20:31 vuln.today
CVE Published
Aug 05, 2026 - 20:17 cve.org
HIGH 8.8

DescriptionCVE.org

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The X-GitHub-Request-Id request header was used without sanitization as a filesystem path segment for the upload buffer directory, so a traversal value pointed the buffer at an arbitrary path and the deferred cleanup routine recursively removed the traversed target. Exploitation required only network reachability to the instance and no authentication, and it worked even when private mode was enabled. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.4, 3.20.6, 3.19.10, 3.18.13 and 3.17.19. This vulnerability was reported via the GitHub Bug Bounty program.

AnalysisAI

Unauthenticated arbitrary file and directory deletion in GitHub Enterprise Server allows any network-reachable attacker to recursively destroy critical instance data - including Git LFS objects, release assets, issue attachments, and user avatars - by injecting a path traversal sequence into the X-GitHub-Request-Id HTTP request header. The vulnerability stems from using this header value unsanitized as a filesystem path component for an upload buffer directory; a deferred cleanup routine then recursively deletes whatever directory the traversal resolves to, including the entire user storage root. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify network-reachable GHES instance
Delivery
Craft HTTP request with traversal payload in X-GitHub-Request-Id header
Exploit
Submit request to upload endpoint
Execution
Server constructs out-of-bounds buffer directory path
Persist
Deferred cleanup routine triggers recursive deletion
Impact
Target directory and all contents destroyed
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The vulnerable code path is the upload endpoint's handling of the X-GitHub-Request-Id header, which is a standard part of the default GitHub Enterprise Server configuration - no non-default feature flag, configuration setting, or optional module is required to trigger this vulnerability. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-assigned CVSS 4.0 score of 8.8 with AV:N/AC:L/AT:N/PR:N/UI:N reflects the actual exploitation conditions accurately: the attack is network-initiated, requires no authentication, no special attack prerequisites, and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with network access to the GHES HTTPS endpoint sends an HTTP request to the upload API endpoint with an X-GitHub-Request-Id header value containing a path traversal sequence such as '../../var/github/user-storage', directing the upload buffer to resolve to the instance's primary user storage directory. When the upload lifecycle completes and the server's deferred cleanup routine executes, it recursively deletes the traversed target directory, destroying all Git LFS objects, release assets, pull request attachments, and user avatars on the instance. …
Remediation Upgrade GitHub Enterprise Server to one of the vendor-confirmed patched releases: 3.17.19, 3.18.13, 3.19.10, 3.20.6, or 3.21.4, as documented in the official release notes at https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.19, https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.13, https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.10, https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.6, and https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.4. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all on-premises GitHub Enterprise Server instances and assess external network accessibility; document existing backup retention policies and tested recovery procedures. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Enterprise Server

View all
CVE-2013-4854 HIGH POC
7.8 Jul 29

The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and

CVE-2024-0200 CRITICAL POC
9.8 Jan 16

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. R
CVE-2024-9487 CRITICAL POC
9.5 Oct 10

An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowe
CVE-2024-4985 CRITICAL
10.0 May 20

An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sig
CVE-2017-7420 CRITICAL
9.8 Aug 21

An Authentication Bypass (CWE-287) vulnerability in ESMAC (aka Enterprise Server Monitor and Control) in Micro Focus Ent
CVE-2023-4501 CRITICAL
9.8 Sep 12

User authentication with username and password credentials is ineffective in OpenText (Micro Focus) Visual COBOL, COBOL

CVE-2022-46255 CRITICAL
9.8 Dec 14

An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server

CVE-2021-22869 CRITICAL
9.8 Sep 24

An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted

CVE-2024-6800 CRITICAL
9.5 Aug 20

An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication wi
CVE-2026-9312 CRITICAL
9.2 May 27

Server-side request forgery in GitHub Enterprise Server lets an unauthenticated attacker coerce the appliance into issui
CVE-2024-1378 CRITICAL
9.1 Feb 13

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor rol
CVE-2024-1374 CRITICAL
9.1 Feb 13

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor rol

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

CVE-2026-17556 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy