PT-2025-46217 · Github · Github Enterprise Server

Inspector-Ambitious · Published 2025-11-10 · Updated 2025-12-08 · CVE-2025-11578

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.19 GitHub Enterprise Server versions 3.14.19 GitHub Enterprise Server versions 3.15.14 GitHub Enterprise Server versions 3.16.10 GitHub Enterprise Server versions 3.17.7 GitHub Enterprise Server versions 3.18.1

Description A privilege escalation issue exists in GitHub Enterprise Server. An authenticated Enterprise admin could obtain root SSH access to the appliance by exploiting a symlink escape within pre-receive hook environments. An attacker could create a malicious repository and environment to replace system binaries during hook cleanup. This allows execution of a payload that adds the attacker’s SSH key to the root user’s authorized keys, granting root SSH access. Exploitation requires enterprise admin privileges.

Recommendations Update to GitHub Enterprise Server version 3.14.19 Update to GitHub Enterprise Server version 3.15.14 Update to GitHub Enterprise Server version 3.16.10 Update to GitHub Enterprise Server version 3.17.7 Update to GitHub Enterprise Server version 3.18.1 Update to GitHub Enterprise Server version 3.19 or later

Fix

LPE

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2025-11578

Affected Products

Github Enterprise Server

References · 15

• https://osv.dev/vulnerability/CVE-2025-11578 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.8 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.11 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11578 · Security Note
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.2 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.15 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.20 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.19 · Note
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.1 · Note
• https://twitter.com/CVEnew/status/1988016792652988444 · Twitter Post
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.7 · Note
• https://t.me/cveNotify/145160 · Telegram Post
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.10 · Note
• https://twitter.com/VulmonFeeds/status/1988129716352549094 · Twitter Post
• https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.14 · Note