This vulnerability (CVE-2026-17556) in GitHub Enterprise Server involves improper limitation of a pathname to a restricted directory (CWE-22). The X-GitHub-Request-Id HTTP header is used without proper sanitization as part of the filesystem path for the upload buffer directory. An attacker can supply a crafted header value containing path traversal sequences to redirect the buffer directory to an arbitrary location. The deferred cleanup routine then recursively deletes the targeted directory and its contents. This allows an unauthenticated attacker with network access to delete arbitrary files and directories, including critical user storage data such as Git LFS objects, release assets, attachments, and avatars. The vulnerability affects all versions prior to 3.22 and was fixed in versions 3.21.4, 3.20.6, 3.19.10, 3.18.13, and 3.17.19. No known exploits in the wild have been reported.

An unauthenticated attacker can delete arbitrary files and directories on the GitHub Enterprise Server instance, including critical user data such as Git LFS objects, release assets, attachments, and avatars. This can lead to significant data loss and disruption of service. The vulnerability can be exploited remotely without authentication and is effective even when private mode is enabled, increasing the risk and potential impact.

This vulnerability has been fixed in GitHub Enterprise Server versions 3.21.4, 3.20.6, 3.19.10, 3.18.13, and 3.17.19. Users should upgrade to one of these fixed versions or later to remediate the issue. Since this is not a cloud service, patching the affected software is required. There is no indication that any temporary or alternative mitigations are available or recommended.