CVE-2026-25855: OpenBullet2 Remote Code Execution via Malicious Script Upload

Technical summary

CVE-2026-25855 is a post-authentication remote code execution vulnerability in OpenBullet2 through version 0.3.2. The vulnerability exists in the FileProxySource proxy loading mechanism, which insufficiently validates uploaded script files. An authenticated attacker can upload malicious files with script extensions (.bat, .ps1, .sh) to the proxy loading functionality. During processing, the server executes these scripts as part of its normal proxy parsing operation, returning command output as proxy configuration lines. The attack exploits improper input handling and lack of sandbox isolation for script execution. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) is the root cause. The vulnerability allows full system compromise with the privileges of the OpenBullet2 process.

Business impact

Organizations running OpenBullet2 face potential complete server compromise if any authenticated user account is compromised or if administrative access is misused. Attackers gain the ability to exfiltrate sensitive data, modify configurations, deploy secondary malware, pivot to other systems, or cause denial of service. For teams using OpenBullet2 in production environments (e.g., for proxy management or security testing), this vulnerability directly enables lateral movement and persistent foothold establishment within infrastructure. The impact is especially severe if the process runs with elevated privileges or within privileged network segments.

Affected systems

All installations of OpenBullet2 through version 0.3.2 are affected. The vulnerability requires the attacker to have valid authentication credentials, so blast radius is limited to environments where OpenBullet2 access is already partially compromised or where weak credential hygiene exists. Any deployment exposing OpenBullet2 to untrusted users or to environments where credential theft is a realistic threat vector should be considered at immediate risk.

Exploitability

Exploitability is high from a technical standpoint: no complex exploitation technique is required—attackers simply upload a malicious script file through an existing feature. However, the requirement for prior authentication significantly reduces the immediate threat surface. The vulnerability becomes critical in scenarios where OpenBullet2 is exposed to internal users with weak passwords, shared accounts, or where authentication is bypassed through other means. No public proof-of-concept or active exploitation has been documented as of the last update, but the straightforward nature of the vulnerability makes exploitation trivial once access is obtained.

Remediation

Upgrade OpenBullet2 to a patched version beyond 0.3.2 immediately. Verify the availability and contents of vendor patches through official OpenBullet2 release channels. Until patching is possible, implement strict network segmentation to restrict access to OpenBullet2 to only trusted administrative users. Enforce multi-factor authentication for all OpenBullet2 accounts, audit and revoke unnecessary credentials, and monitor proxy loading activities for suspicious file uploads. Disable the FileProxySource feature if not actively required.

Patch guidance

Check the official OpenBullet2 repository and release notes for versions released after 0.3.2 that address this vulnerability. Apply the latest stable patch that includes fixes for CVE-2026-25855. Before deployment, validate patches in a non-production environment to ensure compatibility with your proxy configurations and dependent workflows. Document the patch version applied for audit and compliance purposes.

Detection guidance

Monitor OpenBullet2 logs for unusual file upload activity to the FileProxySource proxy loading endpoint, particularly uploads containing script extensions (.bat, .ps1, .sh). Look for authentication events followed by rapid proxy source configuration changes or upload operations. Network-based detection should flag outbound connections initiated from the OpenBullet2 process that deviate from normal proxy activity. Implement file integrity monitoring on OpenBullet2 configuration and script directories. Examine process execution logs for instances of cmd.exe, powershell.exe, bash, or other shells spawned by the OpenBullet2 process (or its parent process).

Why prioritize this

A CVSS 8.8 (HIGH) score reflecting high confidentiality, integrity, and availability impact combined with low attack complexity and network accessibility. While authentication is required, the severity of command execution on the host system justifies immediate attention, especially for organizations where credential compromise is plausible or where OpenBullet2 handles sensitive operations. The straightforward exploitation path and lack of user interaction requirement make this a critical risk to patch.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects the combination of attack vector (network), attack complexity (low), privilege requirements (low—any authenticated user), user interaction (not required), and scope (unchanged). The impact metrics are maximal: confidentiality high (full system information exposure), integrity high (arbitrary code execution), and availability high (denial of service). The primary limiting factor is the authentication requirement, which prevents unauthenticated remote attacks but does not meaningfully reduce risk in environments where credential theft or insider threats are realistic.

Frequently asked questions