Description
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-10-24
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Remote Command Execution
Action: Discontinue
AI Analysis

Impact

An exploitable command injection flaw exists in the /api/auth/setup endpoint of Travisun Opptrix 0.4.0. An attacker that can reach the Schedule API can supply crafted input that is executed as an operating‑system command. The vulnerability is remote, allowing the attacker to run arbitrary commands with the privileges of the running service, potentially leading to full system takeover and data exfiltration.

Affected Systems

The affected product is Travisun Opptrix version 0.4.0. It is a deprecated, offline project that is no longer supported by the maintainer. Only instances of this exact version or earlier builds that contain the same code are vulnerable; newer or actively maintained releases are not affected.

Risk and Exploitability

The base CVSS score is 6.9, indicating moderate severity, and the vulnerability is not listed in CISA’s KEV database. EPSS data is not available, so the current probability of exploitation is unknown. The flaw has an exposed remote command‑injection vector and published exploitation material, which together make it a realistic target for attackers, especially on systems still running the unsupported release.

Generated by OpenCVE AI on October 24, 2026 at 16:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Remove or replace any instance of Travisun Opptrix 0.4.0 from production or test environments.
  • If the application must remain in use, restrict network exposure so that only trusted hosts can reach the /api/auth/setup endpoint.
  • Apply strict input validation or escaping to any user‑supplied parameters that reach system commands, or upgrade to a version that addresses the flaw if available.

Generated by OpenCVE AI on October 24, 2026 at 16:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 24 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
Title Travisun Opptrix Schedule API setup command injection
First Time appeared Travisun
Travisun opptrix
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:travisun:opptrix:*:*:*:*:*:*:*:*
Vendors & Products Travisun
Travisun opptrix
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Travisun Opptrix
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-24T15:30:11.184Z

Reserved: 2026-10-24T00:48:48.974Z

Link: CVE-2026-115969

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-24T16:16:25.343

Modified: 2026-10-24T16:16:25.343

Link: CVE-2026-115969

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T16:30:06Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')