OliveTin up to 3000.0.0 Web Interface templates.go t.Execute race condition

Summaryinfo

A vulnerability identified as problematic has been detected in OliveTin up to 3000.0.0. The affected element is the function t.Execute of the file service/internal/tpl/templates.go of the component Web Interface. The manipulation leads to race condition. This vulnerability is referenced as CVE-2026-48708. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in OliveTin up to 3000.0.0. This issue affects the function t.Execute of the file service/internal/tpl/templates.go of the component Web Interface. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, the template engine uses a single shared text/template.Template instance (tpl package-level variable in service/internal/tpl/templates.go) across all goroutines. Every action execution calls tpl.Parse(source) followed by t.Execute() on this shared instance with no synchronization. When two or more actions execute concurrently (which is the normal case — each ExecRequest spawns a goroutine), a race condition occurs: one goroutine's Parse overwrites the template tree while another goroutine is calling Execute, causing cross-user command contamination, Go runtime panic, and incorrect command execution. This issue has been resolved in version 3000.13.0.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-48708 since 05/22/2026. The exploitation is known to be difficult. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3000.13.0 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• OliveTin

Version

• 3000.0

Website

• Product: https://github.com/OliveTin/OliveTin/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion