A path traversal bug causes the X-GitHub-Request-Id header to be used directly as a file system path segment for an upload buffer. An attacker can craft a traversal value that points the buffer to any path on the host and trigger the deferred cleanup routine to recursively delete the target. This deletes arbitrary files and directories, including user storage, Git LFS objects, release assets, attachments, and avatars. The vulnerability leads to loss of data and denial of service by removing essential assets, and it also exposes the instance to potential data tampering if an attacker pre‑writes files before triggering cleanup.

GitHub Enterprise Server for all releases before version 3.22. The problem was fixed in 3.21.4, 3.20.6, 3.19.10, 3.18.13 and 3.17.19. Any deployment of GitHub Enterprise Server that has not applied one of these patches is affected.

The CVSS score of 8.8 indicates high severity. No authentication is required; the attacker only needs network access to the instance. The vulnerability is publicly documented but not yet listed in the CISA KEV catalog and its EPSS score is unavailable, though the lack of a patch and wide reach suggest a non‑negligible risk. Attackers can exploit the flaw simply by sending an HTTP request with a crafted X‑GitHub‑Request‑Id header, making the window for exploitation wide and easy to automate.