Which versions of OpenBullet2 are affected by CVE-2026-25855?

OpenBullet2 through version 0.3.2 contains a remote code execution vulnerability allowing low-privilege authenticated users to execute arbitrary OS commands on affected systems.

Is there a public PoC exploit available for CVE-2026-25855?

Yes, a public proof-of-concept exploit is available for CVE-2026-25855. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-25855?

Within 24 hours: Inventory all OpenBullet2 instances and restrict network access to trusted networks/users only. Within 7 days: Disable the FileProxySource proxy loading feature if operationally feasible to eliminate the attack vector; otherwise implement strict file upload validation. Within 30 days: Monitor OpenBullet2 repository for patch availability and prepare staged upgrade of all instances; if operational criticality allows, consider temporary system shutdown pending vendor patch release.

OpenBullet2 CVE-2026-25855

Q: What is the CVSS score of CVE-2026-25855?

CVE-2026-25855 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-35134 HIGH

OS Command Injection (CWE-78)

2026-06-08 VulnCheck

GHSA-5jmp-7g8v-5p3h

RCE Command Injection Openbullet2

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Jun 08, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Jun 08, 2026 - 17:22 NVD

8.8 (HIGH) 8.7 (HIGH)

Analysis Generated

Jun 08, 2026 - 17:21 vuln.today

DescriptionCVE.org

OpenBullet2 through version 0.3.2 contains a remote code execution vulnerability that allows authenticated users to execute arbitrary commands by uploading script files (.bat.ps1.sh) through the FileProxySource proxy loading feature. Attackers can upload malicious script files as proxy sources, causing the server to execute the scripts and return output as proxy lines, resulting in arbitrary command execution on the host as the process user.

AnalysisAI

Remote code execution in OpenBullet2 through 0.3.2 allows authenticated users to execute arbitrary OS commands by abusing the FileProxySource proxy loading feature to upload malicious .bat, .ps1, or .sh script files that the server then executes and returns output as proxy lines. Publicly available exploit code exists per the VulnCheck advisory and a HackerNoon writeup, and the issue carries a CVSS 8.8 (High) with low attack complexity and only low-privilege authentication required. No public exploit identified in CISA KEV at time of analysis, but the combination of a documented technique and trivial exploitation path elevates near-term abuse risk.

Technical ContextAI

OpenBullet2 is an open-source web/automation testing suite (cpe:2.3:a:openbullet:openbullet2:*) commonly deployed as a self-hosted .NET web application that loads proxies from multiple sources, including a FileProxySource component that reads proxy lists from files on disk. The root cause maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command, 'OS Command Injection'): instead of treating uploaded proxy source files as inert data, the FileProxySource path passes script files (.bat on Windows, .ps1 for PowerShell, .sh on Linux) through an execution flow whose stdout is then parsed as proxy lines, conflating data input with code execution. The related HackerNoon article also describes an auth-bypass via an empty header, which - if chained - would lower the practical privilege barrier well below the CVSS PR:L assumption.

RemediationAI

No vendor-released patch identified at time of analysis based on the supplied references, so upgrade to a fixed version cannot be cited with a specific version number - monitor the OpenBullet2 GitHub project and the VulnCheck advisory (https://www.vulncheck.com/advisories/openbullet2-authenticated-rce-via-fileproxysource-script-upload) for a tagged release that addresses FileProxySource handling. As compensating controls until a patch ships, restrict access to the OpenBullet2 web UI to trusted operators over a VPN or IP allowlist (trade-off: blocks remote collaborators), disable or remove the FileProxySource proxy loading feature in configuration if your workflow does not require it (trade-off: lose file-based proxy ingestion), and run the OpenBullet2 process under a low-privilege, sandboxed service account with no write access to script directories and outbound network egress filtering to limit blast radius if code execution occurs. Additionally, given the auth-bypass technique described at https://hackernoon.com/one-empty-header-to-admin-how-an-auth-bypass-breaks-openbullet2, audit reverse-proxy and authentication header handling to ensure empty-header requests cannot reach admin endpoints.