CVE-2022-46256

Deeper analysis

A path traversal vulnerability tracked as CVE-2022-46256 affects GitHub Enterprise Server and permits remote code execution during the build process for GitHub Pages sites. The flaw, assigned CWE-22 and rated 8.8 CVSS, resides in the Pages site generation workflow on the appliance; an attacker who can create and trigger a build is able to traverse the file system and execute arbitrary code on the server.

Exploitation requires an account with Pages creation and build permissions on the instance, after which the attacker can achieve full remote code execution with the privileges of the Pages build process. No unauthenticated or low-privilege vector is described.

The vulnerability was fixed in GitHub Enterprise Server releases 3.3.17, 3.4.12, 3.5.9, 3.6.5, and 3.7.2; administrators should apply the corresponding updates referenced in the official release notes for each branch. The issue was identified through the GitHub Bug Bounty program.

EPSS scores for the CVE rose from a low baseline to a recorded peak of 0.0829 (current value 0.0550), indicating measurable post-disclosure exploitation interest that warrants continued monitoring. No public reports of in-the-wild exploitation have been noted in the supplied data.