Executive brief
GitHub Enterprise Server is an on-premises platform for hosting and managing software development. A security flaw was found where an attacker with control over the Dependabot update process could write malicious files to a repository. This could allow an attacker to hijack automated workflows and steal sensitive credentials or secrets used by the organization.
Technical details
A path traversal vulnerability (CWE-22) existed in GitHub Enterprise Server's Dependabot integration. The root cause was insufficient validation of the effective path when processing dependency files and symlink targets within the Dependabot updater container. An attacker with code execution inside this container could bypass path restrictions to write files to arbitrary locations, such as '.github/workflows/'. If the target repository utilized 'pull_request_target' workflows or auto-merge features, these injected workflows could execute with elevated privileges, granting the attacker access to GitHub Actions secrets. The issue affects all versions prior to 3.22 and has been patched in several maintenance releases.
Affected products
- GitHub Enterprise Server < 3.22, fixed in 3.21.3, 3.20.5, 3.19.9, 3.18.12, 3.17.18
Timeline
- 2026-07-17: disclosed
- 2026-07-17: advisory
References
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.19/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.20/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.21/admin/release-notes