Path traversal in GitHub Enterprise Server leading to remote code execution in GitHub Pages

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the instance. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, 3.6.5 and 3.7.2. This vulnerability was reported via the GitHub Bug Bounty program.

N/A

对路径名的限制不恰当(路径遍历)

GitHub Enterprise Server 路径遍历漏洞

GitHub Enterprise Server是美国GitHub开源的一个应用软件。提供一个将自己的GitHub实例设置为虚拟设备，从而提供可扩展，易于管理的平台。 GitHub Enterprise Server存在安全漏洞，该漏洞源于其允许攻击者在构建GitHub Pages站点时利用路径遍历实现远程执行代码。

N/A

N/A