Travisun Opptrix EUVD-2026-109308

Requires network reachability to the Opptrix HTTP API endpoint /api/system-update/import; the CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N) are needed once the endpoint is reachable. The dominant LIMITING factor is deployment mode: the maintainer states Opptrix was intended to run exclusively on localhost and the flaw manifested primarily in local environments, so remote exploitation only applies where an operator has bound/exposed the API to a routable network interface - not the default/intended configuration. Additional limits: the product is deprecated and fully offline, so no new supported instances exist, and the exact malicious input required for the injection is not described in the available sources.

Signals are modest and partly contradictory. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated path and scores 6.9, with exploit maturity E:P (proof-of-concept) - not E:A (attacked). There is no CISA KEV listing and no EPSS value in the input, so there is no signal of active or widespread exploitation; status is no public exploit confirmed as working, only a PoC reference. Crucially, the network vector conflicts with the maintainer's statement that Opptrix was a small learning project 'intended to run exclusively on localhost' and that the flaw 'manifested primarily in local environments' - so while the endpoint is technically network-reachable (AV:N), realistic exposure depends on someone deploying it with the API bound to a routable interface, which the maintainer implies was not the intended use. The vuln.today decision label is 'this_month', not act_now/emergency, consistent with a real-but-not-urgent issue. Net: this is a genuine code-injection (CWE-94) weakness but a low-priority one in practice - an obscure, now-deprecated and fully offline product, no confirmed exploitation, and a deployment model that was localhost-first. Treat the AV:N/impact figures as the theoretical ceiling; verify actual exposure before prioritizing.

An attacker who can reach a deployed Opptrix instance's HTTP API sends a crafted request to /api/system-update/import (the Import Endpoint), injecting code that the application processes, leading to code execution in the app's context. A PoC reference has been published (not verified as working exploit code), and the CVSS AC:L/PR:N/UI:N profile implies no authentication or user interaction is needed - but exploitation first requires the API to be network-reachable, which the maintainer says was not the intended localhost-only deployment.