8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31817

CVE-2026-31817: OliveTin's unsafe parsing of UniqueTrackingId can be used to write files

OliveTin gives access to predefined shell commands from a web interface. Prior to 3000.11.2, when the saveLogs feature is enabled, OliveTin persists execution log entries to disk. The filename used for these log files is constructed in part from the user-supplied UniqueTrackingId field in the StartAction API request. This value is not validated or sanitized before being used in a file path, allowing an attacker to use directory traversal sequences (e.g., ../../../) to write files to arbitrary locations on the filesystem. This vulnerability is fixed in 3000.11.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31817

CVE-2026-31817:

8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/OliveTin/OliveTin	go	< 0.0.0-20260309102040-b03af0e2eca3	0.0.0-20260309102040-b03af0e2eca3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic path traversal issue in OliveTin's saveLogs feature. The root cause is the lack of input sanitization for the UniqueTrackingId field provided by the user in the StartAction API request. This ID is used to construct log file names. An attacker could provide a malicious ID containing directory traversal sequences (e.g., ../../../), allowing them to write log files to arbitrary locations on the filesystem.

The analysis of the provided patch commit 2f77000de44f65690f257e3cf8e2c8462b0e74c7 confirms this. The patch makes changes to service/internal/executor/executor.go. The core of the fix is within the Executor.ExecRequest function. Previously, the code only checked if the TrackingID was a duplicate or empty. The patch introduces a call to a new function, isValidTrackingID, which validates the TrackingID against a regular expression, ensuring it only contains characters suitable for a filename.

Therefore, the primary vulnerable function is Executor.ExecRequest, as it was responsible for accepting the untrusted TrackingID without proper validation. The newly added isValidTrackingID function is a direct indicator of the mitigation strategy. During exploitation, a runtime profile would show a call to Executor.ExecRequest processing the malicious request.

Vulnerable functions

Executor.ExecRequest

service/internal/executor/executor.go

This function receives the `ExecutionRequest` which contains the user-controlled `UniqueTrackingId`. Before the patch, this function only checked if the ID was empty or a duplicate, but did not validate its content for malicious characters. This allowed a path traversal payload (e.g., `../../../`) to be passed in the `TrackingID`, which was later used in file path construction, leading to arbitrary file writes.

isValidTrackingID

service/internal/executor/executor.go

This is a new function added by the patch to perform input validation on the `TrackingID`. Its existence in the patch highlights the lack of validation in the previous version of the code, which is the root cause of the vulnerability. It is a security control function introduced to mitigate the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.