CVE-2020-10518

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in 2.21.6, 2.20.15, and 2.19.21. The underlying issues contributing to this vulnerability were identified both internally and through the GitHub Security Bug Bounty program.

• CWE-77

• https://enterprise.github.com/releases/2.19.21/notesRelease Notes, Vendor Advisory
• https://enterprise.github.com/releases/2.20.15/notesRelease Notes, Vendor Advisory
• https://enterprise.github.com/releases/2.21.6/notesRelease Notes, Vendor Advisory
• https://enterprise.github.com/releases/2.19.21/notesRelease Notes, Vendor Advisory
• https://enterprise.github.com/releases/2.20.15/notesRelease Notes, Vendor Advisory
• https://enterprise.github.com/releases/2.21.6/notesRelease Notes, Vendor Advisory

Published

Aug 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10512HGiga C&Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm …8.8
• CVE-2020-10513The file management interface of iCatch DVR firmware before …6.5
• CVE-2020-10514iCatch DVR firmware before 20200103 do not validate function…8.8
• CVE-2020-10515STARFACE UCC Client before 6.7.1.204 on WIndows allows binar…9.8
• CVE-2020-10516An improper access control vulnerability was identified in t…9.8
• CVE-2020-10517An improper access control vulnerability was identified in G…4.3
• CVE-2020-10519A remote code execution vulnerability was identified in GitH…8.8
• CVE-2020-1052<p>An elevation of privilege vulnerability exists in the way…7.8
• CVE-2020-1053<p>An elevation of privilege vulnerability exists when Direc…7.8
• CVE-2020-10531An issue was discovered in International Components for Unic…8.8
• CVE-2020-10532The AD Helper component in WatchGuard Fireware before 5.8.5.…7.5
• CVE-2020-10534In the GlobalBlocking extension before 2020-03-10 for MediaW…9.8