CVE-2026-25559: OpenBullet2 Path Traversal Remote Code Execution

Technical summary

CVE-2026-25559 is a path traversal vulnerability (CWE-22) affecting OpenBullet2 through version 0.3.2. The vulnerability exists in the wordlist endpoint and upload handler, which fail to properly sanitize absolute paths supplied by authenticated users. This allows attackers to bypass directory restrictions and perform arbitrary file operations. The vulnerability can be chained—specifically, file write and delete primitives can be combined to modify critical system files such as /etc/passwd, achieving remote code execution when the application runs with elevated privileges.

Business impact

An authenticated attacker exploiting this vulnerability can achieve unrestricted system compromise. The combination of read, write, and delete capabilities, coupled with root-level execution, means an attacker could alter system configurations, inject malicious code, create backdoor accounts, or destroy audit logs and evidence. Organizations using OpenBullet2 in production face risk of unauthorized access, data theft, lateral movement to other systems, and operational disruption.

Affected systems

OpenBullet2 versions 0.3.2 and earlier are affected. The vulnerability requires authentication to trigger, so exposure is limited to authorized or compromised user accounts. Systems running OpenBullet2 with root or high-privilege accounts are at maximum risk. Verify your deployed version against the OpenBullet2 release history to confirm exposure.

Exploitability

Exploitation requires valid authentication credentials, which reduces the immediate risk from anonymous attackers. However, the attack surface is broad—any user with login access, including compromised credentials or insider threats, can leverage this flaw without special technical skill or user interaction. The CVSS 3.1 score of 8.8 (HIGH) reflects the high confidentiality, integrity, and availability impact offset only by the authentication requirement.

Remediation

Upgrade OpenBullet2 to a patched version that properly validates and sanitizes file paths in the wordlist endpoint and upload handler. Check the official OpenBullet2 repository or vendor advisory for the minimum secure version. In the interim, restrict network access to the OpenBullet2 service to trusted hosts only, enforce strong authentication controls, and run the application with the minimum necessary privilege level (avoid root execution whenever possible).

Patch guidance

Consult the official OpenBullet2 project repository or advisory for confirmed patch versions that address path traversal in the wordlist endpoint. Apply patches to all instances of OpenBullet2 in your environment, including development, testing, and production. After patching, verify that the upload and wordlist functions reject or safely handle absolute paths. Consider running the application with a dedicated non-root service account to limit impact if other vulnerabilities emerge.

Detection guidance

Monitor application logs for unusual file operations, especially attempts to access or modify files outside the intended wordlist directory. Look for requests to the wordlist endpoint containing path traversal indicators such as `../`, absolute paths (starting with `/`), or encoded equivalents. Set up alerting on failed authentication attempts followed by successful logins, which may indicate credential compromise. Network-based detection should flag requests with suspicious file paths in POST/upload parameters.

Why prioritize this

This vulnerability merits urgent patching because it enables complete system compromise when chained with root execution. The authentication requirement provides some defense, but a single compromised or malicious user account leads to unrestricted file system access and code execution. Organizations should treat this as a critical priority in systems managing sensitive data or running in production environments.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects the combination of network-accessible endpoint (AV:N), low attack complexity (AC:L), high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), and unchanged scope (S:U). The score is High rather than Critical solely because the flaw requires prior authentication (PR:L). In practical terms, the ability to chain file write and delete to achieve RCE as root elevates actual risk significantly.

Frequently asked questions