#VU109635 Exposed dangerous method or function in GitHub Enterprise Server - CVE-2025-3509

Vulnerability identifier: #VU109635

Vulnerability risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-3509

CWE-ID: CWE-749

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
GitHub Enterprise Server
Server applications / Other server solutions

Vendor: GitHub

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists within the pre-receive hook functionality, which becomes available during a hot patch upgrade. A remote user with site administrator permissions or a user with privileges to modify repositories containing pre-receive hooks can execute arbitrary code on the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

GitHub Enterprise Server: 3.13.0, 3.13.2, 3.13.3, 3.13.4, 3.13.5, 3.13.6, 3.13.7, 3.13.8, 3.13.9, 3.13.10, 3.13.11, 3.13.12, 3.13.13, 3.14.0, 3.14.1, 3.14.2, 3.14.3, 3.14.4, 3.14.5, 3.14.6, 3.14.7, 3.14.8, 3.14.9, 3.14.10, 3.15.0, 3.15.1, 3.15.2, 3.15.3, 3.15.4, 3.15.5, 3.16.0, 3.16.1

---

External links
https://docs.github.com/en/enterprise-server@3.13/admin/release-notes#3.13.14
https://docs.github.com/en/enterprise-server@3.14/admin/release-notes#3.14.11
https://docs.github.com/en/enterprise-server@3.15/admin/release-notes#3.15.6
https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.2

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.