Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OliveTin gives access to predefined shell commands from a web interface. Prior to 3000.11.2, when the saveLogs feature is enabled, OliveTin persists execution log entries to disk. The filename used for these log files is constructed in part from the user-supplied UniqueTrackingId field in the StartAction API request. This value is not validated or sanitized before being used in a file path, allowing an attacker to use directory traversal sequences (e.g., ../../../) to write files to arbitrary locations on the filesystem. This vulnerability is fixed in 3000.11.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-10 | 2 | Disclosure2 |
| 2026-03-12 | 1 | General1 |
🔴 OliveTin, Path Traversal, #CVE-2026-31817 (High) https://dailycve.com/olivetin-path-traversal-cve-2026-31817-high/
Post summary
The post merely announces a high‑severity path traversal flaw (CVE‑2026‑31817) in OliveTin without providing details on PoC, exploitation, or remediation.
CVE-2026-31817 OliveTin gives access to predefined shell commands from a web interface. Prior to 3000.11.2, when the saveLogs feature is enabled, OliveTin persists execution log ent… https://www.cve.org/CVERecord?id=CVE-2026-31817
Post summary
The tweet discloses a vulnerability in OliveTin that exposes predefined shell commands via its web interface and logs executions, but does not provide a PoC, exploit, or patch information.
[CVE-2026-31817: HIGH] OliveTin prior to version 3000.11.2 allows directory traversal due to unsanitized user input in the StartAction API request, leading to arbitrary file writes.#cve,CVE-2026-31817,#cybersecurity https://cvefind.com/CVE-2026-31817
Post summary
The tweet announces a high‑severity directory traversal flaw in OliveTin that allows arbitrary file writes, but provides no PoC, exploit details, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | olivetin | olivetin | - | - | - |