CVE-2026-115969
HighCVSS 7.3Summary
A flaw has been found in Travisun Opptrix 0.4.0 affecting an unknown function of the /api/auth/setup file in the Schedule API component. The manipulation causes command injection, and the attack can be initiated remotely. The exploit has been published and may be used.
Risk Assessment
Remote command injection may allow an attacker to execute arbitrary operations on the system, risking full compromise of the application and data confidentiality. The project is no longer supported, so no fixes should be expected.
Recommendation
Stop using Travisun Opptrix 0.4.0 and migrate to a supported alternative. If the application is still running, immediately isolate it from the network and restrict access to the API.
Other vulnerabilities in Travisun Opptrix
See all- CVE-2026-115971Medium
A vulnerability was found in Travisun Opptrix 0.4.0 affecting the Buffer.concat function of the /api/channels/webhook/ file in the preParsing handler component. Manipulation results in denial of service, and the attack can be initiated remotely. The exploit has been made public and could be used.
- CVE-2026-115970High
A vulnerability was found in Travisun Opptrix 0.4.0 affecting an unknown function of the /api/system-update/import file in the Import Endpoint component. Manipulation leads to code injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.
Original NVD description (English source)
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS