# CVE-2026-115970: Travisun Opptrix code injection in system update import

Source: https://junglewise.ai/threats/cve-2026-115970-a-vulnerability-has-been-found-in-travisun-opptrix-0-4-0-this  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-24. Updated: 2026-10-24  
License: CC BY 4.0 with a link back

CVE-2026-115970 · Severity: high · CVSS 7.3 · Published 2026-10-24

Travisun Opptrix is a software management tool that processes system update packages. A code injection vulnerability in its import endpoint allows remote attackers to execute arbitrary code on systems running affected versions. The project has been deprecated and is no longer supported by the maintainers.

Technologies: [Travisun Opptrix](https://junglewise.ai/threats/technologies/opptrix). Vendors: [Travisun](https://junglewise.ai/threats/vendors/travisun).

## Quick answers

**Is CVE-2026-115970 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115970 being exploited in the wild.

**How severe is CVE-2026-115970?** High severity, with a CVSS score of 7.3, published 24 October 2026.

**Which products and versions are affected?** Travisun Opptrix 0.4.0.

**Is there a fix for CVE-2026-115970?** No fixed version is recorded yet. Do not deploy Travisun Opptrix 0.4.0 in any environment, particularly not on internet-facing infrastructure. If already deployed, isolate affected systems from network access or decommission them immediately, as the project is no longer maintained. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-115970 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-115970?** Check whether you run Travisun Opptrix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Do not deploy Travisun Opptrix 0.4.0 in any environment, particularly not on internet-facing infrastructure. If already deployed, isolate affected systems from network access or decommission them immediately, as the project is no longer maintained.

## Technical details

The /api/system-update/import endpoint in Travisun Opptrix 0.4.0 accepts malicious input that leads to code injection, enabling remote code execution without authentication. The vulnerability is reachable over the network and requires no user interaction. This is a design flaw that manifested in local development environments and was never properly remediated before the project was deprecated.

## Affected products

- Travisun Opptrix 0.4.0

## Timeline

- 2026-10-24: disclosed: Vulnerability published to NVD
- 2026-09-19: other: Proof of concept and technical report publicly shared

## References

- [https://drive.google.com/drive/folders/1ni6zbp75v4803pGCG_GGZwEkA0CtaLjl?usp=sharing](https://drive.google.com/drive/folders/1ni6zbp75v4803pGCG_GGZwEkA0CtaLjl?usp=sharing)
- [https://vuldb.com/cve/CVE-2026-115970](https://vuldb.com/cve/CVE-2026-115970)

## Related threats

- [Travisun Opptrix denial of service in webhook handler](https://junglewise.ai/threats/cve-2026-115971-a-vulnerability-was-found-in-travisun-opptrix-0-4-0-affected-is)
- [Travisun Opptrix command injection in Schedule API](https://junglewise.ai/threats/cve-2026-115969-a-flaw-has-been-found-in-travisun-opptrix-0-4-0-this-affects-an)