VulnSocial

CVE-2026-17556Disclosure(github / enterprise_server)

LOWCVSS 9.1 · CRITICAL

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Patch github enterprise_server systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The X-GitHub-Request-Id request header was used without sanitization as a filesystem path segment for the upload buffer directory, so a traversal value pointed the buffer at an arbitrary path and the deferred cleanup routine recursively removed the traversed target. Exploitation required only network reachability to the instance and no authentication, and it worked even when private mode was enabled. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.4, 3.20.6, 3.19.10, 3.18.13 and 3.17.19. This vulnerability was reported via the GitHub Bug Bounty program.

github CVEsBack to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • enterprise_server

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
github
Products
enterprise_server

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-08-29: 2PoC Mentioned / Linked · 2026-08-29: 1Patch / Workaround · 2026-08-29: 1Technical Details · 2026-08-29: 208-29
Signal classification2 categories
Disclosure
150.0%
PoC
150.0%
Referenced assets2 URLs
Full discourse2 posts
  • takenaka hiroya@Joe_Biden_ja
    PoC

    ヘッダの値をパスに使うと何が起きるか、GHES CVE-2026-17556 を Node.js で再現しました。path.resolve は絶対パスを渡されると基準を捨てる。前方一致の検査は安全なものを危険と誤判定する。出力付きで確かめられます。 https://blog.hashito.biz/2026/08/29/ghes-cve-2026-17556-request-header-path-traversal/

    Post summary

    The author demonstrates a proof‑of‑concept for the GitHub Enterprise Server path‑traversal CVE‑2026‑17556 by reproducing the issue in Node.js, but does not report active exploitation or provide a patch, focusing primarily on the vulnerability details.

    0000050
    561 followersView on X
  • takenaka hiroya@Joe_Biden_ja
    Disclosure

    GitHub Enterprise Server に、認証なしでファイルとディレクトリを削除できる欠陥。リクエストヘッダの値をそのままパスに使っていました。private mode を有効にしていても成立します。3.22 より前が該当、修正版は各系列に出ています。 https://cve.autoarticles.net/cve/CVE-2026-17556

    Post summary

    The text announces a vulnerability (unauthenticated file and directory deletion) in GitHub Enterprise Server, specifies affected versions, and notes that patches are available.

    0000070
    561 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgithubenterprise_server---

Explore more

Back to dashboardgithub CVEsenterprise_server vulnerabilities