CVE-2026-115969

Travisun Opptrix Schedule API setup command injection

View on CVE.org
Published Oct 24, 2026 CVSS 4.0 · 6.9 Medium EPSS 1.3% KEV · Not listed
Description
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.

Analysis

AI-generated

Technical impact

The /api/auth/setup endpoint in Travisun Opptrix 0.4.0 allows an attacker to supply crafted input that is executed as a system command. This command injection flaw enables the execution of arbitrary operating‑system commands with the privileges of the running service, leading to potential full system takeover or data exfiltration.

Affected Systems

The vulnerability affects the Travisun Opptrix product, version 0.4.0. This release has been discontinued and is no longer maintained. Based on the description, earlier releases that include the same vulnerable code may also be exposed, although this is not explicitly confirmed; only installations of this exact version or those with the same code are known to be vulnerable.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. The EPSS score of 1% suggests a low but non‑zero probability of exploitation, and the vulnerability is not listed in CISA’s KEV database. An attacker can exploit the flaw remotely by issuing requests to the exposed API endpoint. Public exploit material has been published, which increases the likelihood that attackers will target affected deployments.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Remove Travisun Opptrix 0.4.0 from all environments.
  • If it must remain in use, restrict network exposure so that only trusted hosts can reach the /api/auth/setup endpoint.
  • Implement strict input validation or escaping for any parameters that reach system commands, or upgrade to a version that addresses the flaw if available.

Generated by OpenCVE AI on October 25, 2026 at 17:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
Title Travisun Opptrix Schedule API setup command injection
First Time appeared Travisun
Travisun opptrix
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:travisun:opptrix:*:*:*:*:*:*:*:*
Vendors & Products Travisun
Travisun opptrix
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 29, 2026, 6:26 PM
Reserved
Oct 24, 2026, 12:48 AM

View source JSON

Updated
Oct 29, 2026, 6:26 PM

JSON

Status
Deferred
Published
Oct 24, 2026, 4:16 PM
Modified
Oct 29, 2026, 7:17 PM

View source JSON

No data.

Updated
Oct 26, 2026, 6:52 PM

JSON