CVE-2025-11578: github enterprise_server Link Following

Vulnerability summary

CVE-2025-11578 is a high (CVSS 7.5) Link Following vulnerability in github enterprise_server. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.6% of scored vulnerabilities.

Timeline

1. 10-11-2025
   PublishedVulnerability first disclosed.
2. 02-12-2025
   Last modifiedVulnerability information updated.

Description

A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious repository and environment, an attacker could replace system binaries during hook cleanup and execute a payload that adds their own SSH key to the root user’s authorized keys—thereby granting themselves root SSH access to the server. To exploit this vulnerability, the attacker needed to have enterprise admin privileges. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19, and was fixed in versions 3.14.20, 3.15.15, 3.16.11, 3.17.8, 3.18.2. This vulnerability was reported via the GitHub Bug Bounty program.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.