CVE-2018-11235

HIGH

Debian Linux < 2.13.6 - Path Traversal

Title source: rule
STIX 2.1

Exploitation Summary

EIP tracks 22 public exploits for CVE-2018-11235. PoCs published by qazbnm456, Rogdham, xbl3.

AI-analyzed exploit summary This repository provides a detailed writeup and references for CVE-2018-11235, a Git remote code execution vulnerability. It includes links to external PoCs and technical analysis but does not contain exploit code itself.

Description

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.

Exploits (22)

github WRITEUP 3,480 stars
by qazbnm456 · poc
https://github.com/qazbnm456/awesome-cve-poc/tree/master/CVE-2018-11235.md

This repository provides a detailed writeup and references for CVE-2018-11235, a Git remote code execution vulnerability. It includes links to external PoCs and technical analysis but does not contain exploit code itself.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git < 2.17.1
No auth needed
Prerequisites: vulnerable Git version · ability to manipulate a Git repository
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 48 stars
by Rogdham · poc
https://github.com/Rogdham/CVE-2018-11235

This PoC exploits CVE-2018-11235, a Git vulnerability where arbitrary commands are executed during a recursive submodule clone due to improper path sanitization. The exploit constructs a malicious repository with a symlink and hook to trigger command execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git (versions before 2.17.1, 2.16.4, 2.15.2, 2.14.4, 2.13.7)
No auth needed
Prerequisites: Ability to host a malicious Git repository · Victim must clone the repository with --recurse-submodules
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WRITEUP 14 stars
by xbl3 · poc
https://github.com/xbl3/awesome-cve-poc_qazbnm456/tree/master/CVE-2018-11235.md

This repository provides references and links to external resources related to CVE-2018-11235, a Git RCE vulnerability. It includes links to PoC repositories, ExploitDB entries, and technical writeups but does not contain actual exploit code.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git < 2.17.1
No auth needed
Prerequisites: victim to interact with a malicious Git repository
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 14 stars
by CHYbeta · poc
https://github.com/CHYbeta/CVE-2018-11235-DEMO

This PoC demonstrates CVE-2018-11235, a Git submodule vulnerability allowing RCE via malicious hooks. The exploit constructs a Git repository with a submodule containing a malicious post-checkout hook that executes arbitrary code during clone.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git versions before 2.17.1, 2.16.4, 2.15.2, 2.14.4, and 2.13.7
No auth needed
Prerequisites: Git installed on target system · Ability to convince victim to clone malicious repository
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 3 stars
by qweraqq · poc
https://github.com/qweraqq/CVE-2018-11235-Git-Submodule-CE

This PoC exploits CVE-2018-11235, a Git submodule vulnerability allowing arbitrary command execution via malicious hooks. The exploit involves directory traversal and hook manipulation to achieve RCE when cloning a repository with submodules.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git (versions before 2.17.1, 2.16.4, 2.15.2, 2.14.4)
No auth needed
Prerequisites: Access to a Git server to host the malicious repository · Victim must clone the repository with --recurse-submodules
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 2 stars
by j4k0m · poc
https://github.com/j4k0m/CVE-2018-11235

This PoC exploits CVE-2018-11235, a Git submodule vulnerability allowing RCE via malicious hooks. It sets up a malicious Git repository with a crafted post-checkout hook to execute arbitrary commands upon cloning.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git (versions before 2.17.1, 2.16.4, 2.15.2, 2.14.4, 2.13.7)
No auth needed
Prerequisites: Access to a web server to host the malicious repository · Victim must clone the repository with submodules
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by AnonymKing · poc
https://github.com/AnonymKing/CVE-2018-11235

This repository contains a proof-of-concept exploit for CVE-2018-11235, a Git vulnerability that allows arbitrary code execution via malicious .gitmodules files. The exploit constructs a Git repository with a submodule that triggers the vulnerability when cloned recursively.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git versions before 2.13.7, 2.14.4, 2.15.2, 2.16.4, and 2.17.1
No auth needed
Prerequisites: Vulnerable Git version · Ability to trick a user into cloning a malicious repository
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by ygouzerh · poc
https://github.com/ygouzerh/CVE-2018-11235

This PoC exploits CVE-2018-11235, a Git submodule vulnerability, to achieve RCE by injecting malicious hooks during a recursive clone. The attacker's SSH key is added to the victim's authorized_keys, enabling remote access.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git (versions with submodule vulnerability)
No auth needed
Prerequisites: Victim must perform a recursive Git clone of a malicious repository · Attacker must host a malicious repository with crafted submodule hooks
devstral-2 · analyzed Feb 16, 2026 Full analysis →
gitlab WORKING POC
by jakobgoerke · poc
https://gitlab.com/jakobgoerke/CVE-2018-11235

This repository contains a functional exploit for CVE-2018-11235, a Git submodule vulnerability that allows arbitrary command execution during recursive submodule cloning. The exploit constructs a malicious repository that triggers a reverse shell when cloned with `--recurse-submodules`.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git (versions before 2.17.1, 2.16.4, 2.15.2, 2.14.4, 2.13.7)
No auth needed
Prerequisites: Git client vulnerable to CVE-2018-11235 · Victim must clone the repository with `--recurse-submodules`
devstral-2 · analyzed Feb 23, 2026 Full analysis →
gitlab WORKING POC
by Enigmatrix · poc
https://gitlab.com/Enigmatrix/cve-2018-11235

This repository contains a functional PoC for CVE-2018-11235, a Git submodule vulnerability that allows arbitrary command execution during recursive submodule cloning. The exploit constructs a malicious repository with a symlink and post-checkout hook to execute arbitrary code.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git (versions before 2.17.1, 2.16.4, 2.15.2, 2.14.4, 2.13.7)
No auth needed
Prerequisites: Git client with recursive submodule cloning enabled · Victim must clone the malicious repository with --recurse-submodules flag
devstral-2 · analyzed Feb 23, 2026 Full analysis →
nomisec WORKING POC
by Rezy-Dev · poc
https://github.com/Rezy-Dev/CVE-2018-11235

This repository contains a functional proof-of-concept exploit for CVE-2018-11235, a Git vulnerability allowing remote code execution via malicious submodule hooks. The script automates the creation of a malicious Git repository and configures Apache2 to serve it.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git versions <= 2.17.0
No auth needed
Prerequisites: Apache2 · Git · sudo/root access on the attacker's machine
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by twseptian · poc
https://github.com/twseptian/cve-2018-11235-git-submodule-ce-and-docker-ngrok-configuration

This repository provides a proof-of-concept for CVE-2018-11235, a Git submodule vulnerability that allows remote code execution via malicious hooks. It includes Docker configurations and Ngrok tunneling to expose the exploit server.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git (versions before 2.17.1, 2.16.4, 2.15.2, 2.14.4, and 2.13.7)
No auth needed
Prerequisites: Docker · Ngrok account with authtoken · Vulnerable Git client
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by jongmartinez · poc
https://github.com/jongmartinez/CVE-2018-11235-PoC

This PoC exploits CVE-2018-11235, a Git vulnerability allowing arbitrary code execution via malicious submodule paths. The repository structure demonstrates the exploit by registering submodules with crafted paths to trigger the vulnerability.

Classification
Working Poc 80%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git versions before 2.17.1, 2.16.4, 2.15.2, 2.14.4, and 2.13.7
No auth needed
Prerequisites: Local Git repository setup · Ability to host a malicious Git repository
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB
by xElkomy · poc
https://github.com/xElkomy/CVE-2018-11235

The repository claims to be a PoC for CVE-2018-11235 but contains no exploit code. It only includes placeholder README files and a forked example project (Spoon-Knife).

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB
by nthuong95 · poc
https://github.com/nthuong95/CVE-2018-11235

The repository contains only a README.md file with the CVE identifier and no exploit code or technical details. It appears to be a placeholder or incomplete submission.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by jhswartz · poc
https://github.com/jhswartz/CVE-2018-11235

This repository contains a functional proof-of-concept exploit for CVE-2018-11235, which leverages Git submodule path traversal to execute arbitrary commands via a malicious post-checkout hook. The PoC demonstrates the vulnerability by creating a crafted Git repository with a submodule that triggers command execution during clone.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git (versions before 2.17.1, 2.16.4, 2.15.2, 2.14.4, 2.13.7)
No auth needed
Prerequisites: Git installed on the target system · Ability to convince a user to clone a malicious repository
devstral-2 · analyzed Feb 25, 2026 Full analysis →
nomisec STUB
by knqyf263 · poc
https://github.com/knqyf263/CVE-2018-11235

The repository contains only a README.md file with the CVE identifier and no functional exploit code or technical details. It appears to be a placeholder or stub.

Classification
Stub 10%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by H0K5 · poc
https://github.com/H0K5/clone_and_pwn

This repository contains a functional exploit for CVE-2018-11235, which leverages a vulnerability in Git's submodule handling to achieve remote code execution. The exploit creates a malicious Git repository that, when cloned with the --recurse-submodules flag, executes arbitrary code via a crafted post-checkout hook.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1
No auth needed
Prerequisites: A server to host the malicious Git repository · Victim must clone the repository with --recurse-submodules flag
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by Kiss-sh0t · poc
https://github.com/Kiss-sh0t/CVE-2018-11235-poc

This PoC exploits CVE-2018-11235, a Git submodule vulnerability in Git versions before 2.13.7, 2.14.4, 2.15.2, 2.16.4, and 2.17.1. It demonstrates arbitrary code execution via malicious hooks in a submodule during recursive clone operations.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Git (versions before 2.13.7, 2.14.4, 2.15.2, 2.16.4, 2.17.1)
No auth needed
Prerequisites: Git repository with submodules · Victim performs a recursive clone
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP
by vmotos · poc
https://github.com/vmotos/CVE-2018-11235

This repository contains only a README.md file describing CVE-2018-11235, an RCE vulnerability in Git's submodule cloning functionality. No exploit code or technical details are provided.

Classification
Writeup 30%
Attack Type
Rce
Complexity
Theoretical
Reliability
Theoretical
Target: Git (versions with submodule cloning functionality)
No auth needed
Prerequisites: Access to a vulnerable Git installation
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (11)

Core 11
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/44822/
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2147
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3671-1/
Release Notes, Third Party Advisory x_refsource_misc
https://marc.info/?l=git&m=152761328506724&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1040991
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:1957
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201805-13
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/104345
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4212

Scores

CVSS v3 7.8
EPSS 0.4919
EPSS Percentile 98.7%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-22
Status published
Products (14)
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 17.10
canonical/ubuntu_linux 18.04
debian/debian_linux 8.0
debian/debian_linux 9.0
git-scm/git 2.17.0
git-scm/git < 2.13.6
gitforwindows/git < 2.17.1
redhat/enterprise_linux 7.0
... and 4 more
Published May 30, 2018
Tracked Since Feb 18, 2026