CVE-2026-17556

{"id": "CVE-2026-17556", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17556", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T13:10:54.530503Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "product-cna@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "product-cna@github.com", "affectedData": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "changes": [{"at": "3.17.19", "status": "unaffected"}], "version": "3.17.0", "versionType": "semver", "lessThanOrEqual": "3.17.18"}, {"status": "affected", "changes": [{"at": "3.18.13", "status": "unaffected"}], "version": "3.18.0", "versionType": "semver", "lessThanOrEqual": "3.18.12"}, {"status": "affected", "changes": [{"at": "3.19.10", "status": "unaffected"}], "version": "3.19.0", "versionType": "semver", "lessThanOrEqual": "3.19.9"}, {"status": "affected", "changes": [{"at": "3.20.6", "status": "unaffected"}], "version": "3.20.0", "versionType": "semver", "lessThanOrEqual": "3.20.5"}, {"status": "affected", "changes": [{"at": "3.21.4", "status": "unaffected"}], "version": "3.21.0", "versionType": "semver", "lessThanOrEqual": "3.21.3"}], "defaultStatus": "affected"}]}], "published": "2026-08-05T20:17:06.047", "references": [{"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.19", "tags": ["Product", "Release Notes"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.13", "tags": ["Product", "Release Notes"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.10", "tags": ["Product", "Release Notes"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.6", "tags": ["Product", "Release Notes"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.4", "tags": ["Product", "Release Notes"], "source": "product-cna@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "product-cna@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The X-GitHub-Request-Id request header was used without sanitization as a filesystem path segment for the upload buffer directory, so a traversal value pointed the buffer at an arbitrary path and the deferred cleanup routine recursively removed the traversed target. Exploitation required only network reachability to the instance and no authentication, and it worked even when private mode was enabled. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.4, 3.20.6, 3.19.10, 3.18.13 and 3.17.19. This vulnerability was reported via the GitHub Bug Bounty program."}, {"lang": "es", "value": "Una vulnerabilidad de salto de ruta fue identificada en GitHub Enterprise Server que permit\u00eda a un atacante no autenticado eliminar archivos y directorios arbitrarios en la instancia, incluyendo el directorio completo de almacenamiento de usuario que conten\u00eda objetos Git LFS, activos de lanzamiento, adjuntos y avatares. El encabezado de solicitud X-GitHub-Request-Id fue utilizado sin sanitizaci\u00f3n como un segmento de ruta del sistema de archivos para el directorio de b\u00fafer de carga, por lo que un valor de salto apuntaba el b\u00fafer a una ruta arbitraria y la rutina de limpieza diferida eliminaba recursivamente el objetivo recorrido. La explotaci\u00f3n requer\u00eda solo accesibilidad de red a la instancia y ninguna autenticaci\u00f3n, y funcionaba incluso cuando el modo privado estaba habilitado. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a la 3.22 y fue corregida en las versiones 3.21.4, 3.20.6, 3.19.10, 3.18.13 y 3.17.19. Esta vulnerabilidad fue reportada a trav\u00e9s del programa GitHub Bug Bounty."}], "lastModified": "2026-10-23T21:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "384AEDA5-C4FB-4C1E-A158-C5824DC8C7E9", "versionEndExcluding": "3.17.19"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "209CD8A4-0690-4FBE-8FBF-D8DC01B4C5BA", "versionEndExcluding": "3.18.13", "versionStartIncluding": "3.18.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E67B7806-5FA2-4E22-AC7E-5747D56AC167", "versionEndExcluding": "3.19.10", "versionStartIncluding": "3.19.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86002896-8D6A-42EA-930C-D8E7C5DA3D70", "versionEndExcluding": "3.20.6", "versionStartIncluding": "3.20.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54A93841-1037-4139-A61E-E23BDAB5DD8A", "versionEndExcluding": "3.21.4", "versionStartIncluding": "3.21.0"}], "operator": "OR"}]}], "sourceIdentifier": "product-cna@github.com"}