CVE-2026-115970
HighCVSS 7.3Summary
A vulnerability was found in Travisun Opptrix 0.4.0 affecting an unknown function of the /api/system-update/import file in the Import Endpoint component. Manipulation leads to code injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.
Risk Assessment
A remote attacker could inject code through the import endpoint, potentially leading to application compromise. The project has been taken offline and deprecated, so no fixes should be expected.
Recommendation
Stop using Travisun Opptrix 0.4.0 and migrate to a supported alternative. If the product remains in use, isolate it from the network and block access to the /api/system-update/import endpoint.
Other vulnerabilities in Travisun Opptrix
See all- CVE-2026-115971Medium
A vulnerability was found in Travisun Opptrix 0.4.0 affecting the Buffer.concat function of the /api/channels/webhook/ file in the preParsing handler component. Manipulation results in denial of service, and the attack can be initiated remotely. The exploit has been made public and could be used.
- CVE-2026-115969High
A flaw has been found in Travisun Opptrix 0.4.0 affecting an unknown function of the /api/auth/setup file in the Schedule API component. The manipulation causes command injection, and the attack can be initiated remotely. The exploit has been published and may be used.
Original NVD description (English source)
A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS