A directory traversal vulnerability in OliveTin allows authenticated attackers to perform arbitrary file writes, potentially leading to system compromise.

The application fails to sanitize the UniqueTrackingId parameter in the StartAction API when the saveLogs feature is enabled. This allows an authenticated attacker with low privileges to use directory traversal sequences to write files to arbitrary locations on the host filesystem.

The ability to write files to arbitrary locations on a server can lead to full system compromise, including the deployment of webshells or the overwriting of critical configuration files. Given the CVSS score of 8.5, this high-severity vulnerability poses a significant risk to data integrity and system availability. Unauthorized file system access may also facilitate lateral movement within the network.

Immediate Action: Update OliveTin to version 3000.11.2 or later, which incorporates the necessary input validation to prevent directory traversal.

Proactive Monitoring: Review web server access logs for suspicious API requests containing directory traversal sequences, such as multiple occurrences of dot-dot-slash patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal attempts directed at the StartAction API endpoint.

Public Exploit Available: Unknown.

This vulnerability represents a critical risk to infrastructure integrity due to the potential for arbitrary file writes. Administrators should prioritize patching to version 3000.11.2 immediately to neutralize the threat. If an immediate update is not feasible, restrict access to the web interface and implement strict WAF filtering to prevent exploitation of the StartAction API.