CVE-2026-17556: GitHub Enterprise Server Path Traversal

CVE-2026-17556 Overview

CVE-2026-17556 is a path traversal vulnerability [CWE-22] in GitHub Enterprise Server (GHES) that allows an unauthenticated attacker to delete arbitrary files and directories on the instance. The flaw resides in how GHES handles the X-GitHub-Request-Id HTTP request header, which is used unsanitized as a filesystem path segment for the upload buffer directory. A traversal value redirects the buffer to an arbitrary path, and a deferred cleanup routine then recursively removes the target. Exploitation requires only network reachability to the instance and works even when private mode is enabled. Attackers can wipe the user storage directory containing Git LFS objects, release assets, attachments, and avatars.

Critical Impact
An unauthenticated network-based attacker can recursively delete arbitrary directories on a GHES instance, including the entire user storage directory, causing loss of Git LFS objects, release assets, attachments, and avatars.

Affected Products

GitHub Enterprise Server versions prior to 3.17.19
GitHub Enterprise Server 3.18.x prior to 3.18.13, 3.19.x prior to 3.19.10
GitHub Enterprise Server 3.20.x prior to 3.20.6, and 3.21.x prior to 3.21.4

Discovery Timeline

2026-08-05 - CVE-2026-17556 published to NVD
2026-08-05 - Last updated in NVD database
Vulnerability reported via the GitHub Bug Bounty program

Technical Details for CVE-2026-17556

Vulnerability Analysis

The vulnerability stems from unsanitized use of the attacker-controlled X-GitHub-Request-Id HTTP request header. GHES appends the header value to a filesystem path when constructing the upload buffer directory. Because the header value is never validated for path separators or traversal sequences, an attacker can supply a value such as ../../../../data/user to redirect the buffer directory to an arbitrary location.

After the upload flow completes, a deferred cleanup routine recursively removes the buffer directory. When the buffer path has been redirected via traversal, the cleanup routine recursively deletes the attacker-chosen target. The impact extends to the entire user storage directory, which holds Git LFS objects, release assets, attachments, and avatars.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. GHES treats an attacker-controlled request header as trusted input when composing filesystem paths. There is no canonicalization, no rejection of .. segments, and no confinement check ensuring the resulting path remains inside the intended upload buffer root.

Attack Vector

Exploitation is remote and unauthenticated. An attacker sends an HTTP request to an upload-related endpoint on the GHES instance with a crafted X-GitHub-Request-Id header containing directory traversal sequences. Private mode does not mitigate the flaw because the vulnerable code path is reachable without authentication. Successful exploitation leads to recursive deletion of the referenced directory tree.

No verified proof-of-concept code has been published. See the GitHub Enterprise
Release Notes referenced below for vendor-authoritative details.

Detection Methods for CVE-2026-17556

Indicators of Compromise

Inbound HTTP requests to GHES containing an X-GitHub-Request-Id header value with .., /, or URL-encoded traversal sequences such as %2e%2e%2f.
Unexpected disappearance of directories under the GHES user storage path, including Git LFS objects, release assets, attachments, and avatars.
Application error bursts referencing missing upload buffer or storage paths shortly after anomalous upload traffic.

Detection Strategies

Inspect reverse-proxy and load-balancer logs in front of GHES for X-GitHub-Request-Id header values that deviate from the expected UUID-like format.
Correlate filesystem deletion events on the GHES appliance with concurrent HTTP upload requests from the same client IP.
Alert on any process performing recursive directory removal outside of documented maintenance windows.

Monitoring Recommendations

Enable filesystem audit logging on the GHES data volume, specifically on the user storage root, and forward events to a centralized log platform.
Monitor GHES ghe-config-log and nginx access logs for anomalous header content and request patterns targeting upload endpoints.
Track integrity of Git LFS, release asset, and attachment stores using scheduled inventory snapshots to detect unexpected deletions.

How to Mitigate CVE-2026-17556

Immediate Actions Required

Upgrade GHES to a fixed release: 3.21.4, 3.20.6, 3.19.10, 3.18.13, or 3.17.19.
Restrict network reachability of the GHES instance to trusted networks until the upgrade is applied.
Verify recent backups of Git LFS objects, release assets, attachments, and avatars are available and restorable.

Patch Information

GitHub fixed the vulnerability in GHES 3.21.4, 3.20.6, 3.19.10, 3.18.13, and 3.17.19. All versions prior to 3.22 require an upgrade to one of these patched releases. Refer to the GitHub Enterprise Release Notes 3.21.4, 3.20.6, 3.19.10, 3.18.13, and 3.17.19 for upgrade guidance.

Workarounds

Block or strip the X-GitHub-Request-Id request header at an upstream reverse proxy or web application firewall until the upgrade is completed.
Enforce a strict regular expression on the X-GitHub-Request-Id header value to allow only alphanumeric and hyphen characters, rejecting any request containing path separators or traversal sequences.
Limit inbound access to the GHES web interface to authenticated VPN users or a defined allowlist of source IP ranges.

bash

# Example nginx snippet to strip an untrusted X-GitHub-Request-Id header
# from inbound traffic before it reaches GHES
location / {
    proxy_set_header X-GitHub-Request-Id "";
    proxy_pass https://ghes-backend;
}