CVE-2026-115969: Travisun Opptrix Schedule API setup command injection
A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed?
The affected project was intended to run exclusively on localhost, and the maintainer says the flaw primarily manifested in local environments during earlier development. Any unsupported instance running version 0.4.0, especially one whose Schedule API is reachable beyond localhost, should be treated as exposed.
What does an attacker need to exploit this issue?
The attack can be initiated remotely against the /api/auth/setup endpoint of the Schedule API. The supplied severity vector indicates no privileges or user interaction are required.
Is a public exploit available?
Yes. The exploit has been published and may be used.
What can be done if no supported patch is available?
The maintainer no longer supports the affected products, and the project has been taken offline and deprecated. Restrict access to the affected API to localhost or otherwise remove external reachability, and plan to retire or replace the unsupported deployment.
How can I identify potentially affected systems?
Look for Travisun Opptrix version 0.4.0 and the Schedule API endpoint at /api/auth/setup. Products that are no longer supported by the maintainer are the affected population described in the available information.