Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-115970— Travisun Opptrix Import Endpoint import code injection

Quick assessment

Affected

Travisun Opptrix

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Travisun Opptrix 0.4.0 中发现一个安全漏洞。该漏洞影响组件"Import Endpoint"中文件的某个未知功能。攻击者可通过恶意操作实现代码注入，且该攻击可远程发起。利用方式已公开披露，可能被利用。该项目已完全下线并被弃用。项目维护者说明：“所述安全风险源于设计缺陷，主要出现在早期版本开发阶段的本地环境中。我们此前已针对该特定风险进行了修复；但由于该项目仅限于小规模学习用途，且主版本设计为仅在 localhost 上运行，因此该安全修复仅直接推送至我们的 GitHub 仓库，随后该仓库

CVSS 7.3 · High Updated Oct 25, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Travisun	Opptrix	`0.4.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Travisun Opptrix Import Endpoint import code injection

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

对生成代码的控制不恰当(代码注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Travisun	Opptrix	0.4.0	`cpe:2.3:a:travisun:opptrix::::::::`

II. Public POCs for CVE-2026-115970

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115970

请登录查看更多情报信息。

Other References for CVE-2026-115970 (1)

🔗 Opptrix RCE2 - Google Drive exploit

https://www.cve.org/CVERecord?id=CVE-2026-115970

Same Patch Batch · Travisun · 2026-10-24 · 3 CVEs total

CVE-2026-115969	7.3 HIGH	Travisun Opptrix Schedule API setup command injection
CVE-2026-115971	5.3 MEDIUM	Travisun Opptrix preParsing handler webhook Buffer.concat denial of service

IV. Related Vulnerabilities

Same product: Opptrix

Same vendor: Travisun

Same weakness: CWE-94