PT-2026-24467 · Olivetin · Olivetin

Iconnnjka · Published 2026-03-10 · Updated 2026-03-25 · CVE-2026-31817

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions OliveTin versions prior to 3000.11.2

Description OliveTin provides access to predefined shell commands through a web interface. When the saveLogs feature is enabled, OliveTin persists execution log entries to disk. The filename for these logs is constructed using the UniqueTrackingId field from the StartAction API request. This value is not properly validated or sanitized, allowing an attacker to use directory traversal sequences, such as ../../../, to write files to arbitrary locations on the filesystem. The StartAction API endpoint accepts the UniqueTrackingId variable without validation.

Recommendations Update to version 3000.11.2 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-31817

GHSA-364Q-W7VH-VHPC

GO-2026-4670

SUSE-SU-2026:1042-1

Affected Products

Olivetin

References · 138

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31817.json · Exploit
• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-364q-w7vh-vhpc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31817 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4670 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31817 · Security Note
• https://osv.dev/vulnerability/GHSA-364q-w7vh-vhpc · Vendor Advisory
• https://github.com/OliveTin/OliveTin/commit/2f77000de44f65690f257e3cf8e2c8462b0e74c7 · Note
• https://github.com/OliveTin/OliveTin/releases/tag/3000.11.2 · Note
• https://github.com/OliveTin/OliveTin · Note
• https://suse.com/security/cve/CVE-2026-32110 · Note
• https://suse.com/security/cve/CVE-2026-26195 · Note
• https://suse.com/security/cve/CVE-2026-30914 · Note
• https://suse.com/security/cve/CVE-2026-31892 · Note
• https://suse.com/security/cve/CVE-2026-31960 · Note