Which versions of OpenBullet2 are affected by CVE-2026-25559?

OpenBullet2 version 0.3.2 and below contains a critical path traversal vulnerability (CVE-2026-25559, CVSS 8.7).

Is there a public PoC exploit available for CVE-2026-25559?

Yes, a public proof-of-concept exploit is available for CVE-2026-25559. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-25559?

Within 24 hours: Inventory all systems running OpenBullet2 and identify current versions in use. Within 7 days: Isolate affected systems (version 0.3.2 and below) from production networks or discontinue use until a patch is released. Within 30 days: Evaluate alternative solutions or implement strict compensating controls if operational continuity requires maintaining OpenBullet2.

OpenBullet2 CVE-2026-25559

Q: What is the CVSS score of CVE-2026-25559?

CVE-2026-25559 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-35137 HIGH

Path Traversal (CWE-22)

2026-06-08 VulnCheck

GHSA-7h2f-7rvq-v94v

Path Traversal RCE Openbullet2

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 17:22 vuln.today

CVSS changed

Jun 08, 2026 - 17:22 NVD

8.8 (HIGH) 8.7 (HIGH)

DescriptionCVE.org

OpenBullet2 through version 0.3.2 contains a path traversal vulnerability in the wordlist endpoint that allows authenticated attackers to perform arbitrary file read, write, and delete operations by supplying unsanitized absolute paths to the upload handler and wordlist functions. Attackers can chain the file write and delete primitives to achieve remote code execution by manipulating critical system files such as /etc/passwd, with full system impact since the application runs as root by default.

AnalysisAI

Path traversal in OpenBullet2 through 0.3.2 lets authenticated attackers read, write, and delete arbitrary files via the wordlist endpoint, escalating to remote code execution by tampering with system files like /etc/passwd. Because the application runs as root by default, successful exploitation yields full system compromise. Publicly available exploit code exists (VulnCheck advisory and HackerNoon write-up), though there is no public exploit identified at time of analysis indicating CISA KEV listing.

Technical ContextAI

OpenBullet2 is an open-source web automation and credential-testing suite written in .NET, exposing an HTTP API that includes a wordlist management endpoint for uploading, reading, and deleting dictionary files used by configs. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the upload handler and wordlist functions accept absolute paths from user input without canonicalization or containment to a wordlists directory, so any path the host process can touch becomes addressable. The CPE cpe:2.3:a:openbullet:openbullet2:*:*:*:*:*:*:*:* covers all versions of the product, and the referenced HackerNoon article additionally describes an empty-header authentication bypass that further lowers the bar to reach the vulnerable endpoint.

RemediationAI

No vendor-released patch identified at time of analysis for versions through 0.3.2; operators should monitor the OpenBullet2 GitHub project and the VulnCheck advisory (https://www.vulncheck.com/advisories/openbullet2-path-traversal-via-wordlist-endpoint) for a fixed release and upgrade to any version greater than 0.3.2 once published. Until a patched build is available, remove OpenBullet2 from any internet-exposed network segment and restrict access to the management interface via firewall or VPN to trusted operators only, accepting the trade-off of reduced remote usability. Run the service as an unprivileged dedicated user inside a container or chroot rather than root, which substantially limits the blast radius of the file write/delete primitives at the cost of needing to re-permission the wordlists and config directories, and review logs of the wordlist endpoint for unexpected absolute paths or upload activity. Also mitigate the related authentication bypass described in the HackerNoon reference (https://hackernoon.com/one-empty-header-to-admin-how-an-auth-bypass-breaks-openbullet2) by enforcing strong reverse-proxy authentication in front of the application.