CVE-2023-23760

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to versions 3.8 and was fixed in versions 3.7.7, 3.6.10, 3.5.14, and 3.4.17. This vulnerability was reported via the GitHub Bug Bounty program.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
GitHub	Enterprise Server	>= 3.4.0, <= 3.4.16; >= 3.5.0, <= 3.5.13; >= 3.6.0, <= 3.6.9; >= 3.7.0, <= 3.7.6

References

https://docs.github.com/en/enterprise-server@3.4/admin/release-notes#3.4.17Release Notes
https://docs.github.com/en/enterprise-server@3.5/admin/release-notes#3.5.14Release Notes
https://docs.github.com/en/enterprise-server@3.6/admin/release-notes#3.6.10Release Notes
https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.7Release Notes
https://docs.github.com/en/enterprise-server@3.4/admin/release-notes#3.4.17Release Notes
https://docs.github.com/en/enterprise-server@3.5/admin/release-notes#3.5.14Release Notes
https://docs.github.com/en/enterprise-server@3.6/admin/release-notes#3.6.10Release Notes
https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.7Release Notes

Timeline

Published: Mar 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-237615.3An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other users CVE-2023-237625.3An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect di CVE-2023-237635.3An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain rea CVE-2023-237647.1An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect di CVE-2023-237656.5An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect di CVE-2023-237666.5An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect di CVE-2023-23777.2A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The impacted element is an unknown function of the component Web CVE-2023-237709.8Motorola MBTS Site Controller accepts hard-coded backdoor password. The Motorola MBTS Site Controller Man Machine Interface (MMI), allowing CVE-2023-237718.4Motorola MBTS Base Radio accepts hard-coded backdoor password. The Motorola MBTS Base Radio Man Machine Interface (MMI), allowing for servic CVE-2023-237728.8Motorola MBTS Site Controller fails to check firmware update authenticity. The Motorola MBTS Site Controller lacks cryptographic signature v CVE-2023-237738.8Motorola EBTS/MBTS Base Radio fails to check firmware authenticity. The Motorola MBTS Base Radio lacks cryptographic signature validation fo CVE-2023-237748.4Motorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception. The Motorola MBTS Site Controller exposes a debug prompt on