Vulnerability Description
A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted requests to internal services by exploiting insufficient input validation in an upload endpoint. By injecting path traversal content into request parameters, an attacker could bypass the intended request flow and redirect internal API calls, potentially accessing internal services and exposing sensitive credentials. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.17, 3.18.11, 3.19.8, 3.20.4, and 3.21.2. This vulnerability was reported via the GitHub Bug Bounty program.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Github | Enterprise Server | >= 3.16.0, < 3.16.19 |
Related Weaknesses (CWE)
References
- https://docs.github.com/en/[email protected]/admin/release-notes#3.17.17ProductRelease Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.18.11ProductRelease Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.19.8ProductRelease Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.20.4ProductRelease Notes
- https://docs.github.com/en/[email protected]/admin/release-notes#3.21.2
FAQ
What is CVE-2026-9312?
CVE-2026-9312 is a vulnerability with a CVSS score of 8.2 (HIGH). A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted requests to internal services by exploiting insuf...
How severe is CVE-2026-9312?
CVE-2026-9312 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-9312?
Check the references section above for vendor advisories and patch information. Affected products include: Github Enterprise Server.