CVE-2026-15343 is a path traversal vulnerability (CWE-22) in GitHub Enterprise Server that allowed an attacker with code execution inside the Dependabot updater container to write files to arbitrary paths within a repository. The vulnerability arose because path validation did not properly check the effective path, which could be manipulated via the dependency file's directory and symlink target. This enabled attackers to inject GitHub Actions workflow files under .github/workflows/. If the repository used pull_request_target workflows or had auto-merge enabled, the injected workflows could execute with access to the repository's GitHub Actions secrets. The issue affected all versions prior to 3.22 and was fixed in specific patch releases 3.21.3, 3.20.5, 3.19.9, 3.18.12, and 3.17.18.

An attacker with code execution inside the Dependabot updater container could write arbitrary files to repository paths, including workflow files that could execute with repository secrets. This could lead to unauthorized access to sensitive information and potentially further compromise of the repository environment. The vulnerability is rated high severity with a CVSS 4.0 score of 8.6, indicating significant impact if exploited.

Fixed versions are available: 3.21.3, 3.20.5, 3.19.9, 3.18.12, and 3.17.18. Users should upgrade to one of these versions or later to remediate the vulnerability. Since this is not a cloud service, remediation requires applying the official patches. Patch status is confirmed by the vendor advisory embedded in the description. No additional mitigations are specified.