---
cve: "CVE-2026-48708"
severity: "HIGH"
cvss: 7.5
epss: "40%"
vendor: "OliveTin"
kev: false
exploited: false
published: "2026-06-15 21:17:15"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-03T00:31:28+02:00"
---

# CVE-2026-48708

> 7.5 HIGH · 🧪 PoC

## Beschreibung

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, the template engine uses a single shared text/template.Template instance (tpl package-level variable in service/internal/tpl/templates.go) across all goroutines. Every action execution calls tpl.Parse(source) followed by t.Execute() on this shared instance with no synchronization. When two or more actions execute concurrently (which is the normal case — each ExecRequest spawns a goroutine), a race condition occurs: one goroutine's Parse overwrites the template tree while another goroutine is calling Execute, causing cross-user command contamination, Go runtime panic, and incorrect command execution. This issue has been resolved in version 3000.13.0.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- d74da9314005954dd49fa20dabf272247bc76519 (Commit)
- 8bf52fbea38212e269cbe82f596616b8625a562b (Commit)

## Referenzen

- <https://github.com/OliveTin/OliveTin/security/advisories/GHSA-7fq5-7wr8-rjwj>
- <https://github.com/OliveTin/OliveTin/commit/d74da9314005954dd49fa20dabf272247bc76519>
- <https://github.com/OliveTin/OliveTin/releases/tag/3000.13.0>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-48708) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_