GitHub Enterprise Server CVE-2026-9312

Exploitation requires network access to the GitHub Enterprise Server upload endpoint and does not require authentication or user interaction (PR:N/UI:N), and applies to default configurations of all GHES versions prior to 3.22. The concrete prerequisite is the ability to inject path-traversal content into the upload endpoint's request parameters to break out of the intended request flow and redirect an internal API call. Limiting factors per the CVSS 4.0 vector are high attack complexity (AC:H) and a present attack requirement (AT:P), meaning the attacker must satisfy conditions beyond simply reaching the endpoint for the SSRF to succeed; meaningful credential exposure further depends on the targeted internal services actually being reachable from the appliance, so instances with restricted egress or network segmentation present a harder target.

Signals are mixed and should be weighed rather than taken at face value. CVSS 4.0 rates this 9.2 Critical with a network attack vector (AV:N) and no privileges or user interaction required (PR:N/UI:N), and full high impact to confidentiality, integrity, and availability of the vulnerable system (VC:H/VI:H/VA:H) - explaining the high score and the credential-exposure concern. However, the same vector sets high attack complexity (AC:H) and a present attack requirement (AT:P), meaning successful exploitation depends on conditions outside the attacker's control rather than being a trivial one-shot request; subsequent-system impact is rated none (SC:N/SI:N/SA:N), so the scored impact is confined to the GHES system itself even though SSRF could practically enable further internal pivoting. There is no CISA KEV listing and no public exploit identified, so this is not currently known to be actively exploited or weaponized. EPSS was not provided and cannot be cited. On balance this is a genuine high priority for internet-reachable or widely-accessible GHES instances given unauthenticated network reach and credential exposure, but AC:H/AT:P suggest exploitation is non-trivial rather than mass-automatable; prioritize patching but recognize the barrier to reliable exploitation.

An attacker with network reachability to a GitHub Enterprise Server instance sends a crafted request to the vulnerable upload endpoint, embedding path-traversal content in a request parameter to redirect an internal API call. The appliance then issues that request to an internal service the attacker could not otherwise reach, potentially returning sensitive credentials. No authentication is required (PR:N), but the high complexity and attack requirement (AC:H/AT:P) mean the attacker must satisfy specific conditions to make the redirection succeed; no public proof-of-concept is currently identified.