A server‑side request forgery flaw exists in the upload endpoint of GitHub Enterprise Server. By inserting path‑traversal characters into request parameters, an attacker can cause the server to perform internal HTTP requests, bypassing the intended audience and exposing internal services and potentially sensitive credentials. The vulnerability is active for unauthenticated users and therefore allows attackers to reach protected resources without needing valid credentials.

GitHub Enterprise Server versions prior to 3.22 are affected. The fix was released in 3.16.20, 3.17.17, 3.18.11, 3.19.8, 3.20.4, and 3.21.1; any deployment running an older version must be upgraded to 3.22 or later.

The CVSS score of 9.2 indicates high severity, and the absence of an EPSS value means no historical exploit information is available. The vulnerability is listed as not part of the CISA KEV catalog. Attackers can exploit the flaw by crafting HTTP requests to the public upload API endpoint, using path‑traversal to direct the server to reach internal URLs. Because authentication is not required, the risk persists for all exposed instances until patched.