Path traversal in GitHub Enterprise Server leading to remote code execution

CVE-2023-23760

Summary

A path traversal vulnerability in GitHub Enterprise Server allows attackers to exploit the platform when creating and building GitHub Pages sites. If an attacker has the necessary permissions to create a GitHub Pages site, they can leverage this vulnerability to execute remote code. All versions prior to 3.8 are impacted, with corrective measures implemented in versions 3.7.7, 3.6.10, 3.5.14, and 3.4.17. This vulnerability was reported through the GitHub Bug Bounty program, emphasizing the importance of consistent security assessments.

References