CVE-2022-46256

CVE-2022-46256: Path traversal in GitHub Enterprise Server leading to remote code execution in GitHub Pages

Vendor Github
Product GitHub Enterprise Server
Weakness CWE-22 · Path traversal
Published December 14, 2022
Last update April 22, 2025

CVSS base score

What the vulnerability does

01Description

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the instance. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, 3.6.5 and 3.7.2. This vulnerability was reported via the GitHub Bug Bounty program.

Key dates

02Disclosure timeline

December 14, 2022 CVE published
April 22, 2025 Record updated