Race Condition in OliveTin Web Interface Allowing Shell Command Access
CVE-2026-48708

7.5HIGH

Key Information:

Vendor

Olivetin

Status
Olivetin
Vendor
CVE Published:
15 June 2026

What is CVE-2026-48708?

The OliveTin web interface was found to have a significant vulnerability due to a race condition in its handling of template parsing and execution. In versions 3000.0.0 and prior, the application utilized a single shared template instance across all goroutines without adequate synchronization. This flaw could lead to scenarios where multiple requests overwrite each other's execution context, resulting in unintended command executions and potential cross-user command contamination. The issue has been addressed in version 3000.13.0. Users are advised to upgrade to ensure security.

Affected Version(s)

OliveTin < 3000.13.0

References

https://github.com/OliveTin/OliveTin/security/advisories/...
x_refsource_CONFIRM
https://github.com/OliveTin/OliveTin/releases/tag/3000.13.0
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.