Executive brief
GitHub Enterprise Server is a self-hosted platform for software development and version control. A security vulnerability in the file upload component could allow an unauthenticated attacker to trick the server into making unauthorized requests to internal systems. This could lead to the exposure of sensitive internal credentials or unauthorized access to private internal services.
Technical details
A server-side request forgery (SSRF) vulnerability exists in the upload endpoint of GitHub Enterprise Server due to insufficient input validation. An unauthenticated attacker can inject path traversal sequences into request parameters to bypass intended request flows and redirect internal API calls. This allows the attacker to send crafted requests to internal services, potentially leading to the exposure of sensitive credentials or access to internal-only resources. The vulnerability affects all versions prior to 3.22 and has been patched in several maintenance tracks including 3.16.20, 3.17.17, 3.18.11, 3.19.8, 3.20.4, and 3.21.1.
Affected products
- GitHub Enterprise Server < 3.22
Timeline
- 2026-05-26: advisory: Initial publication of release notes and CVE details.
- 2026-05-27: disclosed: NVD publication date.
References
- https://docs.github.com/en/enterprise-server@3.16/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.19/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.20/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.21/admin/release-notes