CVE-2026-15343High· 8.6▾ TwilightA path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker with code execution inside a Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.2%
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker with code execution inside a Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files under .github/workflows/, because path validation did not check the actual write destination. The initial fix in versions 3.21.3, 3.20.5, 3.19.9, 3.18.12, and 3.17.18 was incomplete because validation checked the supplied symlink target, while the publisher wrote the file using its directory and name. Writing GitHub Actions workflow files required the Dependabot installation to have workflows: write permission. Depending on repository permissions and workflow configuration, including a relevant pull_request_target workflow or auto-merge, an injected workflow could execute with access to GitHub Actions secrets. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.23 and was fully fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118237Medium· 5.3Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service
CVE-2026-104608High· 7.7Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service
CVE-2026-110288Medium· 5.3Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console
CVE-2026-103620Medium· 6.0A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branc…
CVE-2026-63490High· 7.5Handlebars.java provides logic-less and semantic Mustache templates with Java
CVE-2026-55760High· 7.5handlebars.java FileTemplateLoader Path Traversal