A path traversal vulnerability in GitHub Enterprise Server allowed attackers with code execution inside the Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files. This flaw enabled injection of malicious workflows that could execute with access to repository secrets if certain workflows or auto-merge were enabled. The vulnerability affects all versions prior to 3.22 and was fixed in versions 3.21.3, 3.20.5, 3.19.9, 3.18.12, and 3.17.18.