Travisun Opptrix CVE-2026-115969

A reachable Opptrix 0.4.0 instance exposing the Schedule API's /api/auth/setup endpoint is required; manipulation of that endpoint causes command injection, and per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed. Key LIMITING factors: the maintainer states the product was intended to run exclusively on localhost and the flaw 'manifested primarily in local environments', so practical remote exploitation depends on an instance being network-exposed contrary to its design; additionally the product is deprecated and 'completely taken offline', shrinking the real attack surface. This vulnerability only affects versions no longer supported by the maintainer.

The signals point to a low real-world priority despite a network-facing command-injection flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an unauthenticated, low-complexity, remotely-initiable attack, and CWE-77 command injection normally implies arbitrary command execution; however VulDB scored only 6.9 (MEDIUM) by rating each impact LOW (VC:L/VI:L/VA:L). The E:P in the vector corresponds to a PoC/proof-of-concept exploitation state, matching the input's note that only an unverified PoC reference exists. No EPSS score was provided and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation - the vuln.today decision label is 'this_month', not act_now or emergency. The strongest de-prioritizing signal is the maintainer's own statement: the flaw 'manifested primarily in local environments', the project was a 'small learning scope' intended 'to run exclusively on localhost', and it has been 'completely taken offline and deprecated'. This conflicts with the AV:N network rating - CVSS indicates a network vector but the vendor states the product was designed for localhost-only deployment, so realistic remote exposure is far narrower than AV:N alone suggests; verify deployment context before treating this as network-exploitable. Net: a genuine but low-footprint, deprecated-product issue, not a widespread emergency.

A remote attacker sends a crafted request to the /api/auth/setup endpoint of the Schedule API component, injecting operating-system commands that the application executes on the host. A public PoC reference exists (a Google Drive link) but it is not verified as working exploit code, and the product was intended to run only on localhost, so a reachable instance would be required for the scenario to apply.