CVE-2026-15343

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker with code execution inside a Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files under .github/workflows/, because path validation did not check the actual write destination. The initial fix in versions 3.21.3, 3.20.5, 3.19.9, 3.18.12, and 3.17.18 was incomplete because validation checked the supplied symlink target, while the publisher wrote the file using its directory and name. Writing GitHub Actions workflow files required the Dependabot installation to have workflows: write permission. Depending on repository permissions and workflow configuration, including a relevant pull_request_target workflow or auto-merge, an injected workflow could execute with access to GitHub Actions secrets. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.23 and was fully fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-22

• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.18
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.12
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.9
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.5
• https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.3
• https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8
• https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3

Published

Jul 17, 2026

Last Modified

Nov 3, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15337An issue was discovered in Django 5.2 before 5.2.17 and 6.0 …5.3
• CVE-2026-15338The LA-Studio Element Kit for Elementor plugin for WordPress…7.5
• CVE-2026-1534A weakness has been identified in code-projects Online Music…9.8
• CVE-2026-15340lwIP SMTP client does not check the size of inputs, potentia…9.8
• CVE-2026-15341The User Session Synchronizer plugin for WordPress is vulner…9.8
• CVE-2026-15342Plane contains a multi‑tenant authorization flaw in its asse…6.5
• CVE-2026-15344The WP Photo Album Plus plugin for WordPress is vulnerable t…4.9
• CVE-2026-15345The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Opti…4.3
• CVE-2026-15346The VikBooking Hotel Booking Engine & PMS plugin for WordPre…6.1
• CVE-2026-15348The Premium Packages – Sell Digital Products Securely plugin…6.3
• CVE-2026-15349The ERP: Complete HR, Accounting & CRM Suite Built for WooCo…4.3
• CVE-2026-1535A security vulnerability has been detected in code-projects …9.8