CVE-2026-115970

Travisun Opptrix Import Endpoint import code injection

View on CVE.org
Published Oct 24, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.

Analysis

AI-generated

Technical impact

A code injection flaw in the /api/system-update/import endpoint allows remote attackers to execute arbitrary code on servers running Travisun Opptrix 0.4.0. The vulnerability arises from unsanitized input that can be used to inject malicious scripting or command code, leading to full compromise of the affected system. This flaw is an injection weakness classified as CWE-74 and also involves improper code generation (CWE-94), which together expose the system to arbitrary code execution. The impact includes data loss, defacement, and further lateral movement by the attacker.

Affected Systems

The flaw is present only in the deprecated Travisun Opptrix 0.4.0 release. At the time of discovery the product was no longer supported and the maintainer had taken the project offline. No other versions are impacted, and the issue is specific to configurations using the public import endpoint.

Risk and Exploitability

The CVSS score of 6.9 classifies the risk as medium severity. This injection flaw (CWE-74) and code generation weakness (CWE-94) allow remote attackers to execute arbitrary code on exposed instances. Because the exploit is remote and publicly disclosed, an attacker can target any exposed instance of the endpoint. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the lack of updates increases the likelihood of exploitation through legacy deployments. The design flaw was originally intended for local testing environments, yet the vulnerability can still be triggered in remotely exposed installations.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Cease deployment of Travisun Opptrix 0.4.0 and decommission existing installations to eliminate exposure to the code injection flaw (CWE-74) and the improper code generation weakness (CWE-94).
  • Block or remove the /api/system-update/import endpoint to prevent exploitation of the injection weakness (CWE-74).
  • Implement logging and monitoring to detect attempts to exploit the vulnerable endpoint, and apply network segmentation or firewall rules to isolate any remaining environment.

Generated by OpenCVE AI on October 24, 2026 at 18:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
Title Travisun Opptrix Import Endpoint import code injection
First Time appeared Travisun
Travisun opptrix
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:travisun:opptrix:*:*:*:*:*:*:*:*
Vendors & Products Travisun
Travisun opptrix
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 29, 2026, 3:24 PM
Reserved
Oct 24, 2026, 12:48 AM

View source JSON

Updated
Oct 29, 2026, 3:24 PM

JSON

Status
Deferred
Published
Oct 24, 2026, 6:16 PM
Modified
Oct 29, 2026, 4:17 PM

View source JSON

No data.

Updated
Oct 24, 2026, 7:00 PM

JSON