EUVD-2026-35137
GHSA-7h2f-7rvq-v94v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed OpenBullet2 instance
-
DeliveryObtain low-privileged credentials or bypass auth
-
ExploitSend crafted wordlist upload with absolute path
-
ExecutionWrite malicious file as root (e.g. /etc/passwd or cron job)
-
PersistTrigger execution via cron or login
-
ImpactGain root shell on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the OpenBullet2 HTTP API and an authenticated session against the wordlist endpoint (CVSS PR:L); no user interaction is needed. The specific vulnerable surface is the wordlist upload handler and wordlist read/delete functions in OpenBullet2 versions through 0.3.2, which accept unsanitized absolute filesystem paths. Full-system RCE impact is conditional on the default deployment mode where the OpenBullet2 process runs as root - instances run as an unprivileged user are still exploitable for arbitrary file read/write/delete within that user's permissions but not directly to root. The PR:L authentication barrier is materially weakened in environments also affected by the empty-header authentication bypass referenced in the HackerNoon write-up, which can elevate an unauthenticated requester to admin. |
| Impact | The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with high impact across confidentiality, integrity, and availability - consistent with the described root-level RCE primitive. Publicly available exploit code exists (VulnCheck advisory plus a HackerNoon write-up chaining an auth bypass), which sharply increases realistic risk for any internet-exposed OpenBullet2 instance. EPSS data was not provided in the input, and the CVE is not listed in CISA KEV at time of analysis, so there is no public exploit identified at time of analysis confirming active in-the-wild exploitation; however, OpenBullet2's typical user base (offensive-security and credential-testing operators) and the combination of PR:L plus the referenced auth bypass make opportunistic exploitation plausible and worth treating as a real priority rather than a paper-high score. |
| Exploit ScenarioDerived | An attacker with a low-privileged OpenBullet2 account (or one obtained via the referenced auth-bypass write-up) sends an HTTP request to the wordlist upload handler with an absolute path such as /etc/passwd or /etc/cron.d/pwn, writing attacker-controlled content outside the intended wordlists directory. Because the daemon runs as root by default, the planted file is honored by the OS, granting interactive root access on the next cron tick or login attempt. Publicly available exploit code exists, lowering the skill bar to weaponize this within minutes of reachability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Path traversal in OpenBullet2 through 0.3.2 lets authenticated attackers read, write, and delete arbitrary files via the wordlist endpoint, escalating to remote code execution by tampering with system files like /etc/passwd. Because the application runs as root by default, successful exploitation yields full system compromise. Publicly available exploit code exists (VulnCheck advisory and HackerNoon write-up), though there is no public exploit identified at time of analysis indicating CISA KEV listing.
RemediationAI
No vendor-released patch identified at time of analysis for versions through 0.3.2; operators should monitor the OpenBullet2 GitHub project and the VulnCheck advisory (https://www.vulncheck.com/advisories/openbullet2-path-traversal-via-wordlist-endpoint) for a fixed release and upgrade to any version greater than 0.3.2 once published. Until a patched build is available, remove OpenBullet2 from any internet-exposed network segment and restrict access to the management interface via firewall or VPN to trusted operators only, accepting the trade-off of reduced remote usability. Run the service as an unprivileged dedicated user inside a container or chroot rather than root, which substantially limits the blast radius of the file write/delete primitives at the cost of needing to re-permission the wordlists and config directories, and review logs of the wordlist endpoint for unexpected absolute paths or upload activity. Also mitigate the related authentication bypass described in the HackerNoon reference (https://hackernoon.com/one-empty-header-to-admin-how-an-auth-bypass-breaks-openbullet2) by enforcing strong reverse-proxy authentication in front of the application.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenBullet2 is an open-source web automation and credential-testing suite written in .NET, exposing an HTTP API that includes a wordlist management endpoint for uploading, reading, and deleting dictionary files used by configs. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the upload handler and wordlist functions accept absolute paths from user input without canonicalization or containment to a wordlists directory, so any path the host process can touch becomes addressable. The CPE cpe:2.3:a:openbullet:openbullet2:*:*:*:*:*:*:*:* covers all versions of the product, and the referenced HackerNoon article additionally describes an empty-header authentication bypass that further lowers the bar to reach the vulnerable endpoint.
Know when Openbullet2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
OpenBullet2 through version 0.3.2 contains a path traversal vulnerability in the wordlist endpoint that allows authenticated attackers to perform arbitrary file read, write, and delete operations by supplying unsanitized absolute paths to the upload handler and wordlist functions. Attackers can chain the file write and delete primitives to achieve remote code execution by manipulating critical system files such as /etc/passwd, with full system impact since the application runs as root by default.
Executive ViewAI
OpenBullet2 version 0.3.2 and below contains a critical path traversal vulnerability (CVE-2026-25559, CVSS 8.7). Publicly available exploit code exists for this vulnerability; authenticated attackers can achieve remote code execution and complete system compromise. This risk is amplified since OpenBullet2 typically runs with root privileges, creating immediate risk of full infrastructure takeover.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict network access to the wordlist endpoint via network segmentation or firewall rules; (2) run OpenBullet2 with minimal privileges rather than root; (3) implement strict file system monitoring and access controls on sensitive system files; (4) disable wordlist functionality if operationally feasible; (5) establish incident response and backup procedures for affected systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Openbullet2
View allAuthentication bypass in OpenBullet2 through 0.3.2 lets unauthenticated remote attackers obtain full admin access by sen
Remote code execution in OpenBullet2 through 0.3.2 allows authenticated users to execute arbitrary OS commands by abusin
Authenticated remote code execution in OpenBullet2 through version 0.3.2 allows any logged-in user to run arbitrary C# c
Credential disclosure in OpenBullet2 through 0.3.2 on Windows allows authenticated remote attackers to coerce SMB authen
Exploit-DB