Quick answers
- Is CVE-2026-115970 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-115970 being exploited in the wild.
- How severe is CVE-2026-115970?
- High severity, with a CVSS score of 7.3, published 24 October 2026.
- Which products and versions are affected?
- Travisun Opptrix 0.4.0.
- Is there a fix for CVE-2026-115970?
- No fixed version is recorded yet. Do not deploy Travisun Opptrix 0.4.0 in any environment, particularly not on internet-facing infrastructure. If already deployed, isolate affected systems from network access or decommission them immediately, as the project is no longer maintained. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-115970 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-115970?
- Check whether you run Travisun Opptrix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Do not deploy Travisun Opptrix 0.4.0 in any environment, particularly not on internet-facing infrastructure. If already deployed, isolate affected systems from network access or decommission them immediately, as the project is no longer maintained.
Technical details
The /api/system-update/import endpoint in Travisun Opptrix 0.4.0 accepts malicious input that leads to code injection, enabling remote code execution without authentication. The vulnerability is reachable over the network and requires no user interaction. This is a design flaw that manifested in local development environments and was never properly remediated before the project was deprecated.
Affected products
- Travisun Opptrix 0.4.0
Timeline
- 2026-10-24: disclosed: Vulnerability published to NVD
- 2026-09-19: other: Proof of concept and technical report publicly shared