A critical path traversal vulnerability in GitHub Enterprise Server allows unauthenticated remote attackers to perform unauthorized file deletion.

The software fails to properly sanitize input, leading to a path traversal vulnerability (CWE-22). This allows an unauthenticated attacker to target sensitive directories, including those containing Git LFS objects and release assets.

The CVSS score of 8.8 reflects the high potential for service disruption and data loss. An attacker could delete critical repository data, user assets, and system files, leading to a complete denial of service and the loss of intellectual property stored within the enterprise environment.

Immediate Action: Upgrade to the patched versions provided by GitHub (3.17.19, 3.18.13, 3.19.10, 3.20.6, or 3.21.4) as specified in the official release notes.

Proactive Monitoring: Monitor server logs for directory traversal patterns, such as multiple instances of "../" in request paths, and monitor for sudden drops in storage usage or missing file errors.

Compensating Controls: Ensure the GitHub Enterprise instance is isolated behind a robust network perimeter and utilize WAF rules to detect and block path traversal attempts.

Public Exploit Available: Unknown

The ability for an unauthenticated attacker to delete arbitrary files makes this a high-priority incident. Organizations must verify their current version and apply the recommended security updates immediately to protect their development assets.