CVE-2026-15343: Enterprise Server 3.17.0 through 3.17.17; status changes: 3.17.18 — unaffected, 3.18.0 through 3.18.11; status…

Affected technology

Enterprise Server · 3.17.0 through 3.17.17; status changes: 3.17.18 — unaffected, 3.18.0 through 3.18.11; status changes: 3.18.12 — unaffected, 3.19.0 through 3.19.8; status changes: 3.19.9 — unaffected, 3.20.0 through 3.20.4; status changes: 3.20.5 — unaffected, 3.21.0 through 3.21.2; status changes: 3.21.3 — unaffected
GitHub

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says a path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files under .github/workflows/ as the path validation did not check the effective path which the attacker could control through the dependency file's directory and symlink target. Vendor/CNA’s CVSS 4.0 assessment (base score 8.6/10) rates confidentiality and integrity impact as high; availability impact as none.