CVE-2025-11578
BaseFortify
Publication date: 2025-11-10
Last updated on: 2025-12-08
Assigner: GitHub, Inc. (Products Only)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| github | enterprise_server | From 3.14.0 (inc) to 3.14.20 (exc) |
| github | enterprise_server | From 3.15.0 (inc) to 3.15.15 (exc) |
| github | enterprise_server | From 3.16.0 (inc) to 3.16.11 (exc) |
| github | enterprise_server | From 3.17.0 (inc) to 3.17.8 (exc) |
| github | enterprise_server | From 3.18.0 (inc) to 3.18.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-59 | The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a privilege escalation issue in GitHub Enterprise Server that allows an authenticated Enterprise admin to gain root SSH access to the server. It occurs because of a symlink escape in pre-receive hook environments. An attacker with enterprise admin privileges can craft a malicious repository and environment to replace system binaries during hook cleanup, then execute a payload that adds their own SSH key to the root user's authorized keys, granting root SSH access.
How can this vulnerability impact me? :
If exploited, this vulnerability allows an attacker with enterprise admin privileges to gain root SSH access to the GitHub Enterprise Server appliance. This means the attacker can fully control the server, potentially leading to unauthorized access to sensitive data, system compromise, and disruption of services.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately upgrade GitHub Enterprise Server to one of the fixed versions: 3.14.19, 3.15.14, 3.16.10, 3.17.7, or 3.18.1. Additionally, restrict enterprise admin privileges to trusted users only, as exploitation requires authenticated enterprise admin access.