CVE-2026-17556 is a critical path traversal flaw (CVSS 9.1) in GitHub Enterprise Server. An unauthenticated attacker with network access could delete arbitrary files and directories on the instance. GitHub fixed it in 3.21.4, 3.20.6, 3.19.10, 3.18.13 and 3.17.19, so upgrade to the patch release for your version line.
What's affected
All GitHub Enterprise Server versions before 3.22 are affected. Fixed releases, per the CVE record:
- 3.21.x: fixed in 3.21.4
- 3.20.x: fixed in 3.20.6
- 3.19.x: fixed in 3.19.10
- 3.18.x: fixed in 3.18.13
- 3.17.x: fixed in 3.17.19
The record says the flaw works even when private mode is enabled, so a locked down instance is not a mitigation.
How to check if you're exposed
Find your running version from the Management Console, or from the administrative shell:
ghe-version
Compare the result with the fixed releases above. If you are on a line older than 3.17, the record lists no fix for it, so plan a move to a supported release and read the GitHub release notes.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- Take a backup snapshot of the instance before you upgrade.
- Upgrade to the fixed patch release for your line, or to 3.22 or later.
- Restrict network access to the instance to the networks that need it while you wait for a maintenance window.
- After the upgrade, confirm the version with ghe-version and check that storage for LFS objects, releases and attachments is intact.
Why it matters
The record says the X-GitHub-Request-Id request header was used without sanitization as a filesystem path segment for an upload buffer directory. A crafted value pointed the buffer at another location, and the cleanup routine then removed that target recursively. This is the classic shape of CWE-22, path traversal: user input reaches a filesystem path without being constrained.
The impact is integrity and availability, not data theft. The record names the user storage directory, which holds Git LFS objects, release assets, attachments and avatars, as a possible target. The CVE is not in CISA's KEV list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does private mode protect me?
No. The CVE record states exploitation worked even with private mode enabled.
Is there a workaround?
The record does not list one. Upgrade, and limit who can reach the instance in the meantime.
Sources
Last reviewed: 19 October 2026.
