Travisun Opptrix: Command injection in Schedule API (CVE-2026-115969)

Travisun Opptrix version 0.4.0 is affected by a command injection vulnerability within the /api/auth/setup endpoint of the Schedule API component. While the maintainer stated the issue was a design flaw intended for local development environments, the project has been deprecated and taken offline. Remote exploitation of this flaw is possible, and public exploit code exists.

Impact

Successful exploitation allows for remote command injection, potentially leading to unauthorized system access or arbitrary command execution on the host server.

Recommendation

• Inventory systems for any remaining installations of Travisun Opptrix 0.4.0.
• Decommission all instances of the software, as the project is deprecated, taken offline, and no security patches are being provided.
• If immediate removal is not possible, restrict network access to the /api/auth/setup endpoint at the web application firewall or load balancer level.