CVE-2026-17556
Received Received - Intake

Path Traversal in GitHub Enterprise Server

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc. (Products Only)

Description
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The X-GitHub-Request-Id request header was used without sanitization as a filesystem path segment for the upload buffer directory, so a traversal value pointed the buffer at an arbitrary path and the deferred cleanup routine recursively removed the traversed target. Exploitation required only network reachability to the instance and no authentication, and it worked even when private mode was enabled. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.4, 3.20.6, 3.19.10, 3.18.13 and 3.17.19. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-06
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-17556
EUVD
EUVD-2026-53608

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
github enterprise_server to 3.22 (exc)
github enterprise_server 3.21.4
github enterprise_server 3.20.6
github enterprise_server 3.19.10
github enterprise_server 3.18.13
github enterprise_server 3.17.19

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in GitHub Enterprise Server where an unauthenticated attacker can delete arbitrary files and directories by manipulating the X-GitHub-Request-Id header. The vulnerability allows targeting the entire user storage directory, including Git LFS objects, release assets, attachments, and avatars. Exploitation requires only network access and works even with private mode enabled.

Detection Guidance

This vulnerability can be detected by checking the GitHub Enterprise Server version. If your instance is running a version prior to 3.21.4, 3.20.6, 3.19.10, 3.18.13, or 3.17.19, it is vulnerable. No specific commands are provided in the context to detect exploitation, but monitoring for unauthorized file deletions or unusual activity in user storage directories may indicate compromise.

Impact Analysis

An attacker could delete critical files, causing data loss, service disruption, or system compromise. This includes Git repositories, attachments, and other stored content. The impact ranges from loss of intellectual property to complete system unavailability.

Compliance Impact

This vulnerability could lead to unauthorized deletion of sensitive data, including user storage directories containing Git LFS objects, attachments, and avatars. Such data loss or exposure may violate GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information, depending on the data processed.

Mitigation Strategies

Immediately upgrade GitHub Enterprise Server to a patched version (3.21.4, 3.20.6, 3.19.10, 3.18.13, or 3.17.19 or later). If upgrading is not immediately possible, restrict network access to the instance to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17556. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart