CVE-2026-15343: A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the Dependabot updater container to write files to

unknownCVE-2026-15343

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files under .github/workflows/ as the path validation did not check the effective path which the attacker could control through the dependency file's directory and symlink target. If the repository used a pull_request_target workflow or had auto-merge enabled, an injected workflow could execute with access to the repository's GitHub Actions secrets. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.21.3, 3.20.5, 3.19.9, 3.18.12, 3.17.18.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: unknown
Published: 2026-07-17
Last updated: 2026-07-17
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-15343

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-153430.45% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-15343	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEW] [high] Microsoft GitHub Enterprise Server: Multiple vulnerabilitiescert-bund

Recent advisories for A path traversal

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-67309: Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kuberne…nvd · 2026-08-01
mediumCVE-2026-15601: The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulner…nvd · 2026-08-01
highCVE-2026-15450: The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary f…nvd · 2026-08-01
unknownCVE-2026-15244: The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against direc…nvd · 2026-08-01
highGHSA-6hm5-jgcp-p838: Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary Fi…ghsa · 2026-07-31
highGHSA-xh95-f55m-82fw: Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that a…ghsa · 2026-07-31