Vulnerability record · CVE-2018-11235 · published 30 May 2018
CVE-2018-11235: Git submodule name path traversal leads to remote code execution
Debian · Debian Linux
Git versions before 2.13.7, 2.14.4, 2.15.2, 2.16.4 and 2.17.1 mishandle submodule names taken from a crafted .gitmodules file. A name containing "../" is appended to $GIT_DIR/modules, allowing directory traversal that places attacker-controlled content outside the intended submodule path. Post-checkout hooks from that submodule are then executed, defeating the design that hooks are never fetched from a remote.
Description
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityRemote code execution triggered by a routine clone of an untrusted repository, with public exploit code and very high EPSS, though it requires the victim to clone with submodule recursion.
What it is
Git versions before 2.13.7, 2.14.4, 2.15.2, 2.16.4 and 2.17.1 mishandle submodule names taken from a crafted .gitmodules file. A name containing "../" is appended to $GIT_DIR/modules, allowing directory traversal that places attacker-controlled content outside the intended submodule path. Post-checkout hooks from that submodule are then executed, defeating the design that hooks are never fetched from a remote.
Impact
An attacker who controls a repository can execute an arbitrary script on a machine that clones it with --recurse-submodules, giving code execution in the context of the cloning user.
Attack surface
Reached when a user runs git clone --recurse-submodules against a malicious project; no authentication is required, but user interaction (the clone) is needed, matching the CVSS vector AV:L/AC:L/PR:N/UI:R.
Exploitation
Not listed in CISA KEV, but EPSS is high (0.48752, 98.8th percentile) and a public Exploit-DB entry (44822) exists, so working exploit code is publicly available.
What to do
- Upgrade Git to 2.13.7, 2.14.4, 2.15.2, 2.16.4, 2.17.1 or later; apply the vendor errata for Debian, Ubuntu, Red Hat and Gentoo.
- Avoid git clone --recurse-submodules on untrusted repositories until all clients are patched.
- Audit existing clones for unexpected directories under .git/modules and for post-checkout hooks inside submodules.
- Where feasible, restrict or disable submodule recursion in CI and developer tooling that clones external code.
Detection
- Monitor clone operations for .gitmodules entries whose submodule name or path contains "../" or absolute paths.
- Alert on creation or modification of .git/modules/*/hooks/post-checkout and other hook files after a clone.
- Search filesystems and CI workspaces for hook files under .git/modules that were not placed by the local administrator.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
9 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2018-11235 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-11235), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
