CVE-2026-17556: 
GitHub Enterprise Server vulnerability analysis and mitigation

CVE-2026-17556 is a path traversal vulnerability in GitHub Enterprise Server (GHES) that allows an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The root cause is the unsanitized use of the X-GitHub-Request-Id HTTP request header as a filesystem path segment for the upload buffer directory, enabling directory traversal. All versions of GHES prior to 3.22 are affected, spanning the 3.17, 3.18, 3.19, 3.20, and 3.21 release lines. The vulnerability was disclosed on August 5, 2026, and was reported via the GitHub Bug Bounty program. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 8.8 (High) (GitHub Advisory, GHES 3.21 Release Notes).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — 'Path Traversal'). The X-GitHub-Request-Id request header value is consumed without sanitization and used directly as a filesystem path segment to construct the upload buffer directory path. An attacker can supply a traversal sequence (e.g., ../../target/path) in this header, causing the buffer directory to point to an arbitrary location on the filesystem. When the deferred cleanup routine runs, it recursively removes the traversed target directory, effectively enabling unauthenticated remote deletion of arbitrary files and directories. No authentication is required, and the attack succeeds even when GHES private mode is enabled, making the only prerequisite network reachability to the instance (GitHub Advisory, GHES 3.17 Release Notes).

Successful exploitation allows an unauthenticated, network-adjacent attacker to permanently delete arbitrary files and directories on the GHES instance. The most severe impact is the potential destruction of the entire user storage directory, which contains Git LFS objects, release assets, file attachments, and user avatars — resulting in irreversible data loss and a permanent denial of service for affected repositories. There is no confidentiality impact (no data exfiltration), but the integrity and availability impacts are both rated High, as critical repository data can be destroyed and the platform rendered non-functional for users (GitHub Advisory, GHES 3.20 Release Notes).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is rated as automatable by NVD's SSVC assessment, meaning it can be exploited at scale without human interaction. The EPSS score is approximately 0.46%, indicating a relatively low (but non-negligible) probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of the disclosure date. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing or network-accessible GitHub Enterprise Server instances running versions prior to 3.17.19, 3.18.13, 3.19.10, 3.20.6, or 3.21.4 using tools such as Shodan, Censys, or direct network scanning.
2. Craft malicious request: Prepare an HTTP request targeting any GHES endpoint that processes file uploads and uses the X-GitHub-Request-Id header to construct the upload buffer directory path.
3. Inject traversal payload: Set the X-GitHub-Request-Id header to a path traversal value such as ../../data/user/storage or another target directory path (e.g., ../../../../var/lib/ghes/user-storage) to redirect the buffer directory to the desired deletion target.
4. Trigger deferred cleanup: Submit the crafted request to the GHES instance. No authentication is required. The server processes the request and schedules a deferred cleanup routine.
5. Recursive deletion: The cleanup routine executes and recursively removes the traversed target directory, permanently deleting Git LFS objects, release assets, attachments, avatars, or other targeted files (GitHub Advisory, GHES 3.19 Release Notes).

• Network: Unexpected or anomalous HTTP requests to GHES upload endpoints containing path traversal sequences (e.g., ../, %2e%2e%2f, or encoded variants) in the X-GitHub-Request-Id header value; requests originating from unknown or external IP addresses with no corresponding authenticated session.
• File System: Sudden disappearance or mass deletion of files under the user storage directory (e.g., /data/user/storage or equivalent), including Git LFS objects, release assets, attachments, and avatar files; unexpected empty directories where user content previously existed.
• Logs: GHES application or web server access logs showing requests with unusual or malformed X-GitHub-Request-Id header values containing directory traversal patterns; filesystem audit logs (if enabled) recording recursive deletion events initiated by the GHES web service process.
• Process/System: Unexpected recursive rm -rf or equivalent filesystem operations initiated by the GHES application process against directories outside the expected upload buffer path.

GitHub has released patched versions addressing CVE-2026-17556: 3.17.19, 3.18.13, 3.19.10, 3.20.6, and 3.21.4, all released on August 5, 2026. Organizations running GHES 3.22 or later are not affected. Upgrading to one of the fixed versions is the recommended and only confirmed remediation. As a temporary network-level workaround if immediate patching is not possible, restrict network access to the GHES instance to trusted IP ranges to reduce exposure, though this does not eliminate the vulnerability. No configuration-based workaround within GHES itself has been documented (GHES 3.21 Release Notes, GitHub Advisory).