CVE-2026-15343

{
  "id": "CVE-2026-15343",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-17T16:17:13.917",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files under .github/workflows/ as the path validation did not check the effective path which the attacker could control through the dependency file's directory and symlink target. If the repository used a pull_request_target workflow or had auto-merge enabled, an injected workflow could execute with access to the repository's GitHub Actions secrets. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.3, 3.20.5, 3.19.9, 3.18.12, 3.17.18."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de salto de ruta fue identificada en GitHub Enterprise Server que permitía a un atacante que tenía ejecución de código dentro del contenedor del actualizador de Dependabot escribir archivos en rutas de repositorio arbitrarias, incluyendo archivos de flujo de trabajo de GitHub Actions bajo .github/workflows/, ya que la validación de ruta no verificaba la ruta efectiva que el atacante podía controlar a través del directorio del archivo de dependencia y el objetivo del enlace simbólico. Si el repositorio utilizaba un flujo de trabajo pull_request_target o tenía la fusión automática habilitada, un flujo de trabajo inyectado podría ejecutarse con acceso a los secretos de GitHub Actions del repositorio. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server anteriores a la 3.22 y fue corregida en las versiones 3.21.3, 3.20.5, 3.19.9, 3.18.12, 3.17.18."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "GitHub",
          "product": "Enterprise Server",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "3.17.0",
              "lessThanOrEqual": "3.17.17",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.17.18",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "3.18.0",
              "lessThanOrEqual": "3.18.11",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.18.12",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "3.19.0",
              "lessThanOrEqual": "3.19.8",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.19.9",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "3.20.0",
              "lessThanOrEqual": "3.20.4",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.20.5",
                  "status": "unaffected"
                }
              ]
            },
            {
              "version": "3.21.0",
              "lessThanOrEqual": "3.21.2",
              "versionType": "semver",
              "status": "affected",
              "changes": [
                {
                  "at": "3.21.3",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-17T16:31:35.938532Z",
          "id": "CVE-2026-15343",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.17.18",
      "source": "[email protected]"
    },
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.18.12",
      "source": "[email protected]"
    },
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.19.9",
      "source": "[email protected]"
    },
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.20.5",
      "source": "[email protected]"
    },
    {
      "url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.21.3",
      "source": "[email protected]"
    }
  ]
}