CVE-2025-8447

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.18 GitHub Enterprise Server versions 3.14.17 GitHub Enterprise Server versions 3.15.12 GitHub Enterprise Server versions 3.16.8 GitHub Enterprise Server versions 3.17.5

Description: An improper access control issue was identified in GitHub Enterprise Server that allowed users with repository access to retrieve limited code content from other repositories. An attacker needed to know the name of a private repository, along with its branches, tags, or commit SHAs, to trigger compare/diff functionality and retrieve code without authorization.

Recommendations: Update to GitHub Enterprise Server version 3.14.17. Update to GitHub Enterprise Server version 3.15.12. Update to GitHub Enterprise Server version 3.16.8. Update to GitHub Enterprise Server version 3.17.5. Update to GitHub Enterprise Server version 3.18.