GitHub Enterprise Server CVE-2026-17556

The vulnerable code path is the upload endpoint's handling of the X-GitHub-Request-Id header, which is a standard part of the default GitHub Enterprise Server configuration - no non-default feature flag, configuration setting, or optional module is required to trigger this vulnerability. Exploitation requires only TCP network reachability to the GHES HTTPS port (typically 443); the attack succeeds regardless of whether the instance has private mode enabled, removing a configuration control that administrators might otherwise rely on as a security boundary. The CVSS PR:N vector is confirmed - no authentication or valid session is required. No user interaction is required on the server side. The sole limiting factor is network reachability: instances completely isolated behind a perimeter firewall that restricts inbound access to trusted IPs reduce external exposure, but remain vulnerable to any attacker on the permitted network segments. Versions 3.17.19, 3.18.13, 3.19.10, 3.20.6, 3.21.4, and 3.22+ are not affected.

The vendor-assigned CVSS 4.0 score of 8.8 with AV:N/AC:L/AT:N/PR:N/UI:N reflects the actual exploitation conditions accurately: the attack is network-initiated, requires no authentication, no special attack prerequisites, and no user interaction. The impact metrics VI:H and VA:H capture the dual nature of this vulnerability - it can destroy data integrity and render the service unavailable by wiping storage. VC:N confirms there is no confidentiality primitive; this is purely a destructive capability. No EPSS data was provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. The CVE is not listed in the CISA KEV catalog and no public exploit code has been identified, which somewhat reduces immediate urgency. However, the attack mechanics described are straightforward - a single crafted HTTP header value - and the absence of private mode as a protective control eliminates a common assumed boundary for GHES deployments. Organizations with internet-facing GHES instances face the highest real-world risk, but even internally-facing instances are at risk from any attacker with internal network access. The combination of destructive impact, zero authentication barrier, and wide attack surface makes this a higher operational priority than its KEV-absent status might suggest.

An attacker with network access to the GHES HTTPS endpoint sends an HTTP request to the upload API endpoint with an X-GitHub-Request-Id header value containing a path traversal sequence such as '../../var/github/user-storage', directing the upload buffer to resolve to the instance's primary user storage directory. When the upload lifecycle completes and the server's deferred cleanup routine executes, it recursively deletes the traversed target directory, destroying all Git LFS objects, release assets, pull request attachments, and user avatars on the instance. No public proof-of-concept code has been identified at time of analysis, but the attack requires only standard HTTP tooling and knowledge of the header name.