Vulnerabilities

TI-2026-38614 CVE-2026-53541 · GHSA-prj9-97mp-mwh2

OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering

MEDIUM 53

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0038 Published 2026-08-21 Fixed in 0.0.0-20260531214440-ebffd9f040f7 CWE-20

TI-2026-47719 CVE-2026-67439 · GHSA-jm28-2wcr-qf3h

OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

MEDIUM 53

OliveTin gives safe and simple access to predefined shell commands from a web interface.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00433 Published 2026-07-29 Fixed in 3000.17.0, 0.0.0-20260708085316-e421780c9885 CWE-863

TI-2026-47718 CVE-2026-67438 · GHSA-xc5w-4v5w-7x65

OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

MEDIUM 64

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.0159 Published 2026-07-29 Fixed in 3000.17.0, 0.0.0-20260708084548-995ff79736f2 CWE-78

TI-2026-47717 CVE-2026-67437 · GHSA-xpxj-f2fm-rqch

OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

HIGH 72

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00636 Published 2026-07-29 Fixed in 3000.17.0, 0.0.0-20260708075951-ec114e95d297 CWE-400

TI-2026-35990 CVE-2026-48709 · GHSA-f637-w7p2-m7fx

OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration

MEDIUM 51

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00329 Published 2026-06-15 Fixed in 3000.13.0, 0.0.0-20260521230847-a3865704c854 CWE-862

TI-2026-35989 CVE-2026-48708 · GHSA-7fq5-7wr8-rjwj

OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination

HIGH 68

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00402 Published 2026-06-15 Fixed in 3000.13.0, 0.0.0-20260521225117-d74da9314005 CWE-362

TI-2026-24640 CVE-2026-32102 · GHSA-228v-wc5r-j8m7

OliveTin Unauthorized Action Output Disclosure via EventStream

MEDIUM 64

OliveTin gives access to predefined shell commands from a web interface.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0049 Published 2026-03-11 Fixed in 3000.10.2 CWE-284

TI-2026-24370 CVE-2026-31817 · GHSA-364q-w7vh-vhpc

OliveTin's unsafe parsing of UniqueTrackingId can be used to write files

HIGH 70

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00811 Published 2026-03-10 Fixed in 3000.11.2, 0.0.0-20260309102040-b03af0e2eca3 CWE-22

TI-2026-23466 CVE-2026-30233 · GHSA-jf73-858c-54pg

OliveTin: View permission not being checked when returning dashboards

HIGH 68

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0046 Published 2026-03-06 Fixed in 3000.11.1, 0.0.0-20260305082002-d7962710e7c4 CWE-200

TI-2026-23458 CVE-2026-30225 · GHSA-p443-p7w5-2f7f

OliveTin: RestartAction always runs actions as guest

MEDIUM 63

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00457 Published 2026-03-06 Fixed in 3000.11.1, 0.0.0-20260305000458-cb46a597b246 CWE-250

TI-2026-23456 CVE-2026-30223 · GHSA-g962-2j28-3cg9

OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes

HIGH 79

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00332 Published 2026-03-06 Fixed in 3000.11.1, 0.0.0-20260304231339-e97d8ecbd8d6 CWE-287

TI-2026-23457 CVE-2026-30224 · GHSA-gq2m-77hf-vwgh

OliveTin: Session Fixation - Logout Fails to Invalidate Server-Side Session

MEDIUM 58

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00333 Published 2026-03-06 Fixed in 3000.11.1, 0.0.0-20260304233115-d6a0abc3755d15 CWE-384

TI-2026-22985 CVE-2026-28790 · GHSA-4fqm-6fmh-82mq

OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login

HIGH 72

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00739 Published 2026-03-05 Fixed in 3000.11.0, 0.0.0-20260302002902-d9804182eae4 CWE-284

TI-2026-22984 CVE-2026-28789 · GHSA-45m3-398w-m2m9

OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling

HIGH 72

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00453 Published 2026-03-05 Fixed in 3000.10.3, 0.0.0-20260301235225-f044d90d5525c CWE-362

TI-2026-22627 CVE-2026-28342 · GHSA-pc8g-78pf-4xrp

OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint

HIGH 72

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0075 Published 2026-03-05 Fixed in 3000.10.2, 0.0.0-20260227002407-2eb5f0ba79d4 CWE-400

TI-2026-22008 CVE-2026-27626 · GHSA-49gm-hh7w-wfvf

OS command injection in OliveTin

HIGH 76

OliveTin gives access to predefined shell commands from a web interface.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00637 Published 2026-02-25 Fixed in 0.0.0-20260222101908-4bbd2eab1532 CWE-78

TI-2025-32274 CVE-2025-50946 · GHSA-p3qf-84rg-jxfc

OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function…

HIGH 70

OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01285 Published 2025-08-13 No fix listed CWE-78

Vulnerabilities

Filters