Remote Code Execution in OliveTin Web Interface
CVE-2026-27626

10CRITICAL

Key Information:

Vendor

Olivetin

Status
Olivetin
Vendor
CVE Published:
25 February 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-27626?

OliveTin, a web interface tool, has a significant vulnerability due to improper handling of shell commands. Up to version 3000.10.0, the safety check 'checkShellArgumentSafety' fails to properly filter 'password' argument types. This oversight allows authenticated users to inject harmful shell metacharacters, executing arbitrary OS commands. Furthermore, an independent flaw enables unauthenticated remote code execution (RCE) via JSON values extracted from webhooks, completely bypassing type safety checks before the commands reach 'sh -c'. If both vulnerabilities are exploited, attackers can gain unrestricted access to any OliveTin instance utilizing Shell mode with webhook actions. As of the latest information, no patch has been released for this security issue.

Affected Version(s)

OliveTin <= 3000.10.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-27626
Created by Shisones

References

https://github.com/OliveTin/OliveTin/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.