Description
A path traversal vulnerability was identified in GitHub Pages builds on GitHub Enterprise Server that could allow an attacker to read system files. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.0.19, 3.1.11, and 3.2.3. This vulnerability was reported via the GitHub Bug Bounty program.
References (3)
Core 3
Core References
Various Sources x_refsource_misc
https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.19
Various Sources x_refsource_misc
https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.11
Various Sources x_refsource_misc
https://docs.github.com/en/enterprise-server%403.2/admin/release-notes#3.2.3
Scores
CVSS v3
6.5
EPSS
0.0110
EPSS Percentile
61.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-22
CWE-23
Status
published
Products (1)
github/enterprise_server
< 3.0.19
Published
Nov 10, 2021
Tracked Since
Feb 18, 2026