High · published November 11, 2025
⚡ An authenticated enterprise admin can unwittingly grant themselves root access through a crafty symlink escape in GitHub Enterprise Server! 🔥 Think of it like a hotel manager who has the keys to the entire building, but someone slips a fake reservation under their door, allowing them to access every room without anyone noticing. That’s the kind of sneaky access this vulnerability allows! An attacker with enterprise admin privileges can exploit this vulnerability to replace critical system binaries, giving them root SSH access. This could lead to complete system compromise, allowing the attacker to control the server as if they were the rightful owner—an absolutely devastating outcome for any organization!
Think of it like a hotel manager who has the keys to the entire building, but someone slips a fake reservation under their door, allowing them to access every room without anyone noticing. That’s the kind of sneaky access this vulnerability allows! This privilege escalation flaw occurs due to a symlink escape during pre-receive hook cleanup, enabling an attacker to execute a payload that adds their SSH key to the root user’s authorized keys, thereby obtaining root SSH access to the server.
An attacker with enterprise admin privileges can exploit this vulnerability to replace critical system binaries, giving them root SSH access. This could lead to complete system compromise, allowing the attacker to control the server as if they were the rightful owner—an absolutely devastating outcome for any organization! Immediately update your GitHub Enterprise Server to version 3.19 or later to mitigate this vulnerability. If you’re on an earlier version, consider patching to 3.14.20, 3.15.15, 3.16.11, 3.17.8, or 3.18.2 to ensure your systems are secure. It’s vital to regularly review and audit repository hooks as an extra safety measure! You've got this! With these updates, you can secure your server and maintain your superhero status in the world of security! 🦸
| Product | Versions | Fixed in |
|---|---|---|
| github/enterprise_server | ≥ 3.14.0, < 3.14.20 | 3.14.20 |
| github/enterprise_server | ≥ 3.15.0, < 3.15.15 | 3.15.15 |
| github/enterprise_server | ≥ 3.16.0, < 3.16.11 | 3.16.11 |
| github/enterprise_server | ≥ 3.17.0, < 3.17.8 | 3.17.8 |
| github/enterprise_server | ≥ 3.18.0, < 3.18.2 | 3.18.2 |