CVE-2022-46255
Published: 14 December 2022
Summary
CVE-2022-46255 is a critical-severity Path Traversal (CWE-22) vulnerability in Github Enterprise Server. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 11.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-46255 is an improper limitation of a pathname to a restricted directory vulnerability, tracked as CWE-22, that affected GitHub Enterprise Server version 3.7.0. The flaw resided in the Pages component and permitted an arbitrary file overwrite that could be leveraged for remote code execution; it was reported through the GitHub Bug Bounty program and carried a CVSS 3.1 score of 9.8.
An unauthenticated attacker with network access could exploit the issue without user interaction to overwrite files and achieve remote code execution on the affected server. The vulnerability was present only in the single release 3.7.0.
The official GitHub Enterprise Server 3.7.1 release notes document the addition of a check inside Pages that ensures the working directory is clean before unpacking new content, thereby preventing the overwrite condition. The EPSS score for the CVE rose from a low baseline to a peak of 0.0945 on 2025-12-18 before receding to its current value of 0.0389.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-49074
Vulnerability details
An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. A check was added within Pages to ensure the working directory is clean before unpacking new content to…
more
prevent an arbitrary file overwrite bug. This vulnerability affected only version 3.7.0 of GitHub Enterprise Server and was fixed in version 3.7.1. This vulnerability was reported via the GitHub Bug Bounty program.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.