CVE-2026-48708 Details
Description
OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, the template engine uses a single shared text/template.Template instance (tpl package-level variable in service/internal/tpl/templates.go) across all goroutines. Every action execution calls tpl.Parse(source) followed by t.Execute() on this shared instance with no synchronization. When two or more actions execute concurrently (which is the normal case — each ExecRequest spawns a goroutine), a race condition occurs: one goroutine's Parse overwrites the template tree while another goroutine is calling Execute, causing cross-user command contamination, Go runtime panic, and incorrect command execution. This issue has been resolved in version 3000.13.0.
A race condition vulnerability has been identified in OliveTin versions 3000.0.0 and prior, within the template engine. The issue arises because a single shared instance of 'text/template.Template' is used across all goroutines without proper synchronization. This flaw allows concurrent actions to interfere with each other, leading to cross-user command contamination, Go runtime panics, and incorrect execution of commands. The vulnerability has been patched in version 3000.13.0.
The vulnerability can be remediated by creating a new template instance for each parse call, rather than using a shared instance. Alternatively, the 'tpl.Clone()' method can be used to create a thread-safe copy of the template for each execution, or a mutex can be added to synchronize access to the template, although this may impact performance.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 15, 2026CISA-ADP
Assessed Jun 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OliveTin/OliveTin/security/advisories/GHSA-7fq5-7wr8-rjwj | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/OliveTin/OliveTin/commit/d74da9314005954dd49fa20dabf272247bc76519 | [email protected] | |
| https://github.com/OliveTin/OliveTin/releases/tag/3000.13.0 | [email protected] | Release NotesVendor |
| https://github.com/OliveTin/OliveTin/security/advisories/GHSA-7fq5-7wr8-rjwj | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
| CWE-567 | Unsynchronized Access to Shared Data in a Multithreaded Context | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OliveTin | >= 3000.0.0 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | New CVE Received | [email protected] |