CVE-2018-11235
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a...
- Published
- May 30, 2018
- Updated
- Aug 5, 2024
- Assigning CNA
- mitre
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HModerate · next 30 days
- Percentile
- 98.8%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
Sources
CVE-2018-11235（PoC && Exp）
- clone_and_pwnExploit
Exploits CVE-2018-11235
Proof-of-concept exploit for CVE-2018-11235, a remote code execution vulnerability in Git submodules. Includes Dockerfile for reproducible testing and analysis.
PoC exploit for CVE-2018-11235 allowing RCE on git clone --recurse-submodules
RCE vulnerability to exec "git clone --recurse-submodule" (CVE-2018-11235)
PoC exploit for CVE-2018-11235 allowing RCE on git clone --recurse-submodules
Demonstrates exploitation of CVE-2018-11235, a Git submodule RCE vulnerability, with build script and analysis for educational purposes.
- CVE-2018-11235Exploit
Automated creation of malicious Git repositories to exploit CVE-2018-11235, a remote code execution vulnerability in Git submodules.
for git v2.7.4
Proof-of-concept exploit for CVE-2018-11235, a remote code execution vulnerability in Git submodules. Demonstrates exploitation of malicious .gitmodules files to execute arbitrary commands during clone operations.
CVE-2018-11235-Git PoC
- CVE-2018-11235Exploit
exploit poc for CVE-2018-11235
CVE-2018-11235-Git-Submodule-CE + Docker Ngrok Configuration
- CVE-2018-11235Exploit
Shell-based exploit for CVE-2018-11235, a remote code execution vulnerability in Git submodules. Enables testing and validation of the flaw in affected systems.
Proof of Concept - RCE Exploitation : Git submodules' names vulnerability - Ensimag November 2018
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.