CVE-2023-22380

Path traversal in GitHub Enterprise Server leading to arbitrary file reading when building a GitHub Pages site

State: Published
Severity: 6.5 Medium
Published: Feb 16, 2023
Updated: Mar 19, 2025
Reserved: Dec 20, 2022

Description

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.6. This vulnerability was reported via the GitHub Bug Bounty program.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

CWE-22 Path Traversal

Affected Products

Product	Versions
GitHub Enterprise ServerGitHub	3.7 to before 3.7.6Affected

References

https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.6

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.