CVE-2026-15343— Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths

AI Predicted 8.8 Difficulty: Easy Updated Jul 18, 2026

Possible ATT&CK Techniques 3AI

T1053 · Scheduled Task/Job T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Affected Version Matrix 5

Vendor	Product	Version Range	Status
GitHub	Enterprise Server	`3.17.0≤ 3.17.17`	affected
		`3.18.0≤ 3.18.11`	affected
		`3.19.0≤ 3.19.8`	affected
		`3.20.0≤ 3.20.4`	affected
		`3.21.0≤ 3.21.2`	affected

Updated Jul 18, 2026

Get alerts for future matching vulnerabilitiesLog in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths

Source: NVD (National Vulnerability Database)

Vulnerability Description

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files under .github/workflows/ as the path validation did not check the effective path which the attacker could control through the dependency file's directory and symlink target. If the repository used a pull_request_target workflow or had auto-merge enabled, an injected workflow could execute with access to the repository's GitHub Actions secrets. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.3, 3.20.5, 3.19.9, 3.18.12, 3.17.18.

Source: NVD (National Vulnerability Database)

CVSS Information

N/A

Source: NVD (National Vulnerability Database)

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: NVD (National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
GitHub	Enterprise Server	3.17.0 ~ 3.17.17	-

II. Public POCs for CVE-2026-15343

#	POC Description	Source Link	Shenlong Link

AI-Generated POCPremium

No public POC found.

III. Intelligence Information for CVE-2026-15343

请登录查看更多情报信息。

https://nvd.nist.gov/vuln/detail/CVE-2026-15343

Same Patch Batch · GitHub · 2026-07-17 · 4 CVEs total

CVE-2026-54163	4.7 MEDIUM	secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when give
CVE-2026-15007		Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via
CVE-2026-15783		Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowe

IV. Related Vulnerabilities

Same product: Enterprise Server

Same vendor: GitHub

Same weakness: CWE-22

V. Comments for CVE-2026-15343

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-15343— Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file paths

Possible ATT&CK Techniques 3AI

Affected Version Matrix 5

I. Basic Information for CVE-2026-15343

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-15343

III. Intelligence Information for CVE-2026-15343

Same Patch Batch · GitHub · 2026-07-17 · 4 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-15343

Leave a comment