Executive brief
GitHub Enterprise Server, a self-hosted code repository platform used by enterprises to manage source code and collaboration, contains a race condition vulnerability in its file upload mechanism. An authenticated repository user with write access could exploit precise timing of concurrent upload requests to execute arbitrary code on the server, potentially gaining full control of the platform and access to all stored source code and secrets.
Technical details
A time-of-check time-of-use (TOCTOU) race condition vulnerability exists in GitHub Enterprise Server's repository file upload functionality. The vulnerability requires an authenticated attacker with write access to a target repository and the ability to send precisely-timed concurrent upload requests to exploit the race window. By manipulating the timing of multiple upload operations, an attacker can bypass validation checks and achieve remote code execution on the server. The vulnerability affects all versions prior to 3.22; patches were released in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. No public exploitation has been reported.
Affected products
- GitHub Enterprise Server prior to 3.22; fixed in 3.17.20, 3.18.14, 3.19.11, 3.20.7, 3.21.5
Timeline
- 2026-09-01: disclosed