EUVD-2026-45189
GHSA-h327-qh69-cgch
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Multi-step prerequisites (container code execution, symlink setup, specific repo config) justify AC:H; PR:L for an authenticated updater context; S:C as the file write escalates into secret-bearing workflow execution.
Primary rating from Vendor (GitHub_P).
CVSS VectorVendor: GitHub_P
Lifecycle Timeline
2DescriptionCVE.org
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files under .github/workflows/ as the path validation did not check the effective path which the attacker could control through the dependency file's directory and symlink target. If the repository used a pull_request_target workflow or had auto-merge enabled, an injected workflow could execute with access to the repository's GitHub Actions secrets. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.3, 3.20.5, 3.19.9, 3.18.12, 3.17.18.
AnalysisAI
Arbitrary file write in GitHub Enterprise Server (all releases before 3.22) lets an attacker who already has code execution inside the Dependabot updater container escape the intended dependency-file directory via path traversal and symlink manipulation, planting attacker-controlled files anywhere in a repository - including GitHub Actions workflows under .github/workflows/. Because path validation checked the declared rather than the effective (symlink-resolved) path, an injected workflow can run with the repository's Actions secrets when the repo uses pull_request_target or auto-merge. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS 4.0 base score is 8.6 (High).
Technical ContextAI
The flaw is a CWE-22 path traversal in the Dependabot dependency-update pipeline of GitHub Enterprise Server (cpe:2.3:a:github:enterprise_server). Dependabot runs updaters inside a container that parses a repository's dependency manifests and writes updated files back into the repo. The updater derived write destinations from attacker-influenceable inputs - the dependency file's directory and a symlink target - and validated the nominal path without resolving symlinks, so the effective on-disk path could point outside the intended location. Writing into .github/workflows/ turns a file-write primitive into code execution, because GitHub Actions automatically loads workflow definitions, and pull_request_target / auto-merge run those workflows in a privileged context with access to repository secrets.
RemediationAI
Vendor-released patch: upgrade GitHub Enterprise Server to the fixed release on your maintenance track - 3.21.3, 3.20.5, 3.19.9, 3.18.12, or 3.17.18 (versions 3.22 and later are unaffected). Follow the corresponding admin release notes linked above for upgrade procedures. Where immediate patching is not possible, reduce exposure by limiting the blast radius of the secret-access path: disable auto-merge and avoid pull_request_target triggers on repositories that process untrusted dependency updates (trade-off: loss of automation and of the specific PR context those triggers provide), and consider scoping or removing Actions secrets from repositories that run Dependabot on untrusted input so a planted workflow has nothing valuable to steal. These are compensating controls only; upgrading to a fixed version is the definitive fix.
Supply chain vulnerability in Eclipse Theia GitHub Actions workflow. The preview.yml workflow uses pull_request_target w
Supply chain attack vector in OpenLIT GitHub Actions workflows. The pull_request_target trigger with checkout enables ma
Eigent multi-agent workflow CI pipeline (ci.yml) uses pull_request_target with checkout of untrusted PR code, enabling a
An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. R
cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Rated critical severity (CVSS 9.
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowe
Unauthenticated infrastructure overwrite in Hoppscotch API development ecosystem before 2026.2.0. Attackers can overwrit
A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCrede
OneUptime versions prior to 10.0.19 allow unauthenticated attackers to hijack GitHub App integrations across projects by
PolarLearn versions 0-PRERELEASE-15 and earlier lack proper state parameter validation in OAuth 2.0 authentication, enab
Path traversal in esm.sh CDN prior to version 0.0.0-20260116051925-c62ab83c589e allows unauthenticated remote attackers
actions/artifact is the GitHub ToolKit for developing GitHub Actions. Rated high severity (CVSS 7.5), this vulnerability
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today