PT-2026-43434 · Github · Github Enterprise Server

Ahacker1 · Published 2026-05-26 · Updated 2026-06-30 · CVE-2026-9312

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22

Description A server-side request forgery (SSRF) issue exists where an unauthenticated attacker can send crafted requests to internal services due to insufficient input validation in an upload endpoint. By injecting path traversal content into request parameters, an attacker can bypass the intended request flow and redirect internal API calls, which may lead to the access of internal services and exposure of sensitive credentials. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update to version 3.16.20 Update to version 3.17.17 Update to version 3.18.11 Update to version 3.19.8 Update to version 3.20.4 Update to version 3.21.1

Fix

LPE

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2026-07906

CVE-2026-9312

Affected Products

Github Enterprise Server

References · 19

• https://bdu.fstec.ru/vul/2026-07906 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-9312 · Security Note
• https://twitter.com/threadlinqs/status/2059661411526005161 · Twitter Post
• https://t.me/cveNotify/165686 · Telegram Post
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.8 · Note
• https://twitter.com/integ_sec/status/2066494698080883020 · Twitter Post
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.17 · Note
• https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.2 · Note
• https://twitter.com/the_yellow_fall/status/2059454366357303596 · Twitter Post
• https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.1 · Note
• https://t.me/CVEtracker/55049 · Telegram Post
• https://twitter.com/UndercodeUpdate/status/2060282429005255117 · Twitter Post
• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.4 · Note
• https://twitter.com/UpwindMDR/status/2059515119680315834 · Twitter Post
• https://t.me/cveNotify/181557 · Telegram Post