CVE-2025-11578 is a vulnerability classified under CWE-59 (Improper Link Resolution Before File Access) affecting GitHub Enterprise Server versions 3.14 through 3.18. The flaw arises from insecure handling of symbolic links in the pre-receive hook environment, a mechanism used to enforce policies before accepting Git pushes. An authenticated enterprise admin can exploit this by creating a specially crafted repository and environment that triggers a symlink escape during the cleanup phase of pre-receive hooks. This escape allows the attacker to overwrite or replace critical system binaries on the server. By doing so, the attacker can execute arbitrary code with root privileges, specifically by adding their SSH public key to the root user’s authorized_keys file. This grants persistent root SSH access to the underlying appliance hosting GitHub Enterprise Server. The vulnerability requires high privileges (enterprise admin) and does not require user interaction, but the impact on confidentiality, integrity, and availability is severe. The issue was responsibly disclosed via GitHub’s Bug Bounty program and fixed in multiple patch releases starting with 3.14.19. The CVSS v4.0 score is 7.5, reflecting high severity with network attack vector, high privileges required, and no user interaction.

For European organizations using GitHub Enterprise Server, this vulnerability poses a significant risk of full server compromise if exploited by a malicious insider or a threat actor who has obtained enterprise admin credentials. Root SSH access allows attackers to manipulate all data, configurations, and repositories hosted on the appliance, potentially leading to intellectual property theft, sabotage, or lateral movement within the corporate network. Given the critical role of GitHub Enterprise in software development pipelines, exploitation could disrupt development workflows and compromise the integrity of software supply chains. The risk is heightened in sectors with stringent compliance requirements such as finance, healthcare, and critical infrastructure, where unauthorized root access could lead to regulatory violations and severe reputational damage.

European organizations should immediately verify their GitHub Enterprise Server versions and upgrade to the fixed releases (3.14.19, 3.15.14, 3.16.10, 3.17.7, or 3.18.1 and later). Restrict enterprise admin privileges strictly to trusted personnel and enforce multi-factor authentication to reduce the risk of credential compromise. Implement monitoring and alerting for unusual SSH key additions to root’s authorized_keys file and audit pre-receive hook configurations for unauthorized changes. Employ network segmentation to isolate GitHub Enterprise appliances from critical infrastructure and sensitive data stores. Regularly review and rotate SSH keys and credentials associated with administrative accounts. Consider deploying host-based intrusion detection systems (HIDS) to detect unauthorized file modifications. Finally, conduct internal security awareness training focused on the risks of privilege misuse and enforce the principle of least privilege across all administrative roles.