CVE-2026-115971
MediumCVSS 5.3Summary
A vulnerability was found in Travisun Opptrix 0.4.0 affecting the Buffer.concat function of the /api/channels/webhook/ file in the preParsing handler component. Manipulation results in denial of service, and the attack can be initiated remotely. The exploit has been made public and could be used.
Risk Assessment
A remote attacker could cause denial of service by overloading the webhook handler, disrupting application availability. The project has been taken offline and deprecated, so no fixes will be provided.
Recommendation
Stop using Travisun Opptrix 0.4.0 and migrate to a supported solution. If the product remains in use, isolate it from the network and restrict access to the /api/channels/webhook/ endpoint.
Other vulnerabilities in Travisun Opptrix
See all- CVE-2026-115970High
A vulnerability was found in Travisun Opptrix 0.4.0 affecting an unknown function of the /api/system-update/import file in the Import Endpoint component. Manipulation leads to code injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-115969High
A flaw has been found in Travisun Opptrix 0.4.0 affecting an unknown function of the /api/auth/setup file in the Schedule API component. The manipulation causes command injection, and the attack can be initiated remotely. The exploit has been published and may be used.
Original NVD description (English source)
A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.concat of the file /api/channels/webhook/ of the component preParsing handler. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been made public and could be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS