CVE-2026-31817: OliveTin Path Traversal Vulnerability

CVE-2026-31817 Overview

OliveTin is a web interface that provides access to predefined shell commands. A directory traversal vulnerability exists in OliveTin prior to version 3000.11.2 that allows attackers to write arbitrary files to the filesystem. When the saveLogs feature is enabled, OliveTin persists execution log entries to disk using filenames constructed in part from the user-supplied UniqueTrackingId field in the StartAction API request. This value is not validated or sanitized before being used in a file path, enabling attackers to use directory traversal sequences (e.g., ../../../) to write files to arbitrary locations on the filesystem.

Critical Impact

Authenticated attackers can exploit this directory traversal vulnerability to write arbitrary files anywhere on the filesystem, potentially leading to remote code execution, configuration tampering, or system compromise.

Affected Products

• OliveTin versions prior to 3000.11.2
• OliveTin installations with saveLogs feature enabled
• Systems exposing OliveTin web interface to untrusted networks

Discovery Timeline

• 2026-03-10 - CVE CVE-2026-31817 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-31817

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal). The flaw exists in how OliveTin handles user-supplied input when constructing file paths for log persistence. When the saveLogs feature is active, OliveTin writes execution logs to disk using filenames that incorporate the UniqueTrackingId parameter from StartAction API requests. The application fails to validate or sanitize this input, allowing malicious path traversal sequences to escape the intended log directory.

The attack requires authentication (low privileges) but can be executed remotely over the network with no user interaction. The vulnerability has a changed scope, meaning successful exploitation can impact resources beyond the vulnerable component itself. While confidentiality impact is none, the integrity impact is high as attackers can write arbitrary content to any filesystem location accessible by the OliveTin process, and availability impact is low.

Root Cause

The root cause is improper input validation in the log file path construction logic. The UniqueTrackingId field from the StartAction API request is directly concatenated into file paths without sanitization, allowing directory traversal sequences like ../ to manipulate the final destination path. This violates the security principle of never trusting user input for filesystem operations.

Attack Vector

The attack vector is network-based and requires low-privilege authentication. An attacker with valid credentials can craft a malicious StartAction API request containing directory traversal sequences in the UniqueTrackingId field. When the saveLogs feature processes this request, it will write the log file to an attacker-controlled path on the filesystem.

The exploitation flow involves:

1. Authenticating to the OliveTin web interface with low-privilege credentials
2. Sending a crafted StartAction API request with a malicious UniqueTrackingId value containing path traversal sequences
3. OliveTin processes the request and writes the log file to the attacker-specified location
4. The attacker can potentially overwrite configuration files, inject malicious scripts, or achieve code execution depending on the target file and system configuration

For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-31817

Indicators of Compromise

• Unexpected files appearing outside the configured OliveTin log directory
• API requests to StartAction endpoint containing ../ or encoded traversal sequences in the UniqueTrackingId field
• Modified system configuration files or unexpected script files with content resembling log entries
• Anomalous file write operations by the OliveTin process to sensitive directories

Detection Strategies

• Monitor OliveTin API requests for path traversal patterns in the UniqueTrackingId parameter including ../, ..%2f, %2e%2e/, and similar encoded variants
• Implement file integrity monitoring on critical system directories to detect unauthorized modifications
• Enable detailed logging for the OliveTin process and alert on file operations outside expected directories
• Deploy web application firewall rules to block requests containing directory traversal sequences

Monitoring Recommendations

• Configure SentinelOne to monitor file write operations by the OliveTin process, alerting on writes outside the designated log directory
• Implement network-level monitoring for API requests to OliveTin endpoints with suspicious payloads
• Review OliveTin access logs regularly for unusual UniqueTrackingId values or repeated failed exploitation attempts

How to Mitigate CVE-2026-31817

Immediate Actions Required

• Upgrade OliveTin to version 3000.11.2 or later immediately
• If immediate patching is not possible, disable the saveLogs feature until the update can be applied
• Review filesystem for any unexpected files that may have been created through exploitation
• Audit OliveTin access logs for suspicious API requests containing traversal patterns

Patch Information

The vulnerability is fixed in OliveTin version 3000.11.2. Organizations should upgrade to this version or later to remediate the vulnerability. The security fix implements proper input validation and sanitization for the UniqueTrackingId field before it is used in file path construction.

For official patch details, see the OliveTin Security Advisory.

Workarounds

• Disable the saveLogs feature in OliveTin configuration if log persistence is not required
• Restrict network access to OliveTin to trusted networks only using firewall rules
• Implement a reverse proxy with WAF capabilities to filter malicious requests before they reach OliveTin
• Run OliveTin with minimal filesystem permissions to limit the impact of arbitrary file writes

# Disable saveLogs in OliveTin configuration
# Edit your OliveTin config.yaml file
saveLogs: false

# Restrict OliveTin to localhost only if remote access is not needed
listenAddressSingleHTTPFrontend: "127.0.0.1:1337"