GitHub Enterprise Server up to 3.13.13/3.14.10/3.15.5/3.16.1 code injection

Summaryinfo

A vulnerability labeled as critical has been found in GitHub Enterprise Server up to 3.13.13/3.14.10/3.15.5/3.16.1. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to code injection. This vulnerability is tracked as CVE-2025-3509. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in GitHub Enterprise Server up to 3.13.13/3.14.10/3.15.5/3.16.1. It has been declared as critical. This vulnerability affects an unknown part. The manipulation with an unknown input leads to a code injection vulnerability. The CWE definition for the vulnerability is CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-receive hook functionality, potentially leading to privilege escalation and system compromise. The vulnerability involves using dynamically allocated ports that become temporarily available, such as during a hot patch upgrade. This means the vulnerability is only exploitable during specific operational conditions, which limits the attack window. Exploitation required either site administrator permissions to enable and configure pre-receive hooks or a user with permissions to modify repositories containing pre-receive hooks where this functionality was already enabled. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.17 and was fixed in versions 3.16.2, 3.15.6, 3.14.11, 3.13.14. This vulnerability was reported via the GitHub Bug Bounty program.

The weakness was disclosed by R31n. The advisory is available at docs.github.com. This vulnerability was named CVE-2025-3509 since 04/10/2025. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are required for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1059 by the MITRE ATT&CK project.

Upgrading to version 3.13.14, 3.14.11, 3.15.6, 3.16.2 or 3.17 eliminates this vulnerability. The upgrade is hosted for download at docs.github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Bug Tracking Software

Vendor

• GitHub

Name

• Enterprise Server

Version

• 3.13.0
• 3.13.1
• 3.13.2
• 3.13.3
• 3.13.4
• 3.13.5
• 3.13.6
• 3.13.7
• 3.13.8
• 3.13.9
• 3.13.10
• 3.13.11
• 3.13.12
• 3.13.13
• 3.14.0
• 3.14.1
• 3.14.2
• 3.14.3
• 3.14.4
• 3.14.5
• 3.14.6
• 3.14.7
• 3.14.8
• 3.14.9
• 3.14.10
• 3.15.0
• 3.15.1
• 3.15.2
• 3.15.3
• 3.15.4
• 3.15.5
• 3.16.0
• 3.16.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion