CVE-2026-9312

Vulnerability

A server-side request forgery (SSRF) vulnerability exists in the upload endpoint of GitHub Enterprise Server (GHES) versions prior to 3.22. The bug is due to insufficient input validation of request parameters, allowing path traversal content to redirect internal API calls. An unauthenticated attacker with network access to the affected GHES instance can exploit this flaw [1][2][3][4].

Exploitation

An attacker with network access to the GHES instance can send crafted requests to the upload endpoint. By injecting path traversal sequences into request parameters, the attacker can bypass the intended request flow and redirect internal API calls to arbitrary internal services. No authentication is required for this exploit [1][2][3][4].

Impact

Successful exploitation allows the attacker to send forged requests to internal services reachable from the GHES instance. This can lead to exposure of sensitive credentials and unauthorized access to internal resources, potentially compromising the confidentiality of the affected system [1][2][3][4].

Mitigation

GitHub has addressed the vulnerability by adding input validation to request parameters. Fixed versions include 3.16.20, 3.17.17, 3.18.11, 3.19.8, 3.20.4, and 3.21.1. Administrators should update GHES instances to the latest patched version. As of the publication date, there is no known KEV listing [1][2][3][4].