EUVD-2026-35134
GHSA-5jmp-7g8v-5p3h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain OpenBullet2 user credentials or bypass auth
-
DeliveryAuthenticate to web UI over network
-
ExploitUpload malicious .ps1/.sh/.bat script
-
InstallRegister file as FileProxySource
-
C2Trigger proxy load to execute script
-
ExecuteCommand execution as service user
-
ImpactPivot or persist on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must (1) have authenticated access to an OpenBullet2 instance at version 0.3.2 or earlier with network reachability to the web UI, and (2) be able to reach the FileProxySource proxy-loading feature to register a script file (.bat on Windows hosts, .ps1 for PowerShell, or .sh on Linux hosts) as a proxy source. Limiting factors: a valid user session is required (CVSS PR:L), and the target host's shell/interpreter must match the uploaded script type, so .ps1 payloads only fire on Windows hosts with PowerShell and .sh on Linux - though the related empty-header auth-bypass writeup at hackernoon.com suggests the authentication barrier may be bypassable in some deployments, effectively lowering this prerequisite. |
| Impact | CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a network-reachable, low-complexity, authenticated attack with full CIA impact and no user interaction - consistent with abusing an authenticated upload endpoint to achieve code execution as the OpenBullet2 process user. Publicly available exploit code (VulnCheck advisory plus a HackerNoon walkthrough) raises practical exploitability; however, EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The vulnerability is not listed in CISA KEV based on the supplied data, so 'confirmed actively exploited' status does not apply. Two caveats: (1) the referenced auth-bypass article suggests PR:L may overstate the real barrier if the bypass is chained, and (2) OpenBullet2 is itself an offensive-tooling platform often deployed on attacker infrastructure, which skews who is realistically targeted - defenders running it for legitimate testing should treat this as a high priority, but enterprise fleet exposure is likely narrow. |
| Exploit ScenarioDerived | An attacker with a low-privileged OpenBullet2 account (or one obtained via the related empty-header auth bypass) authenticates to the web UI and adds a new FileProxySource pointing at an uploaded malicious .ps1 or .sh script containing arbitrary commands. When OpenBullet2 loads the proxy source, it executes the script and reads stdout as 'proxy lines,' which yields arbitrary command execution as the OpenBullet2 process user; publicly available exploit details from VulnCheck and HackerNoon make this trivial to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Remote code execution in OpenBullet2 through 0.3.2 allows authenticated users to execute arbitrary OS commands by abusing the FileProxySource proxy loading feature to upload malicious .bat, .ps1, or .sh script files that the server then executes and returns output as proxy lines. Publicly available exploit code exists per the VulnCheck advisory and a HackerNoon writeup, and the issue carries a CVSS 8.8 (High) with low attack complexity and only low-privilege authentication required. No public exploit identified in CISA KEV at time of analysis, but the combination of a documented technique and trivial exploitation path elevates near-term abuse risk.
RemediationAI
No vendor-released patch identified at time of analysis based on the supplied references, so upgrade to a fixed version cannot be cited with a specific version number - monitor the OpenBullet2 GitHub project and the VulnCheck advisory (https://www.vulncheck.com/advisories/openbullet2-authenticated-rce-via-fileproxysource-script-upload) for a tagged release that addresses FileProxySource handling. As compensating controls until a patch ships, restrict access to the OpenBullet2 web UI to trusted operators over a VPN or IP allowlist (trade-off: blocks remote collaborators), disable or remove the FileProxySource proxy loading feature in configuration if your workflow does not require it (trade-off: lose file-based proxy ingestion), and run the OpenBullet2 process under a low-privilege, sandboxed service account with no write access to script directories and outbound network egress filtering to limit blast radius if code execution occurs. Additionally, given the auth-bypass technique described at https://hackernoon.com/one-empty-header-to-admin-how-an-auth-bypass-breaks-openbullet2, audit reverse-proxy and authentication header handling to ensure empty-header requests cannot reach admin endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenBullet2 is an open-source web/automation testing suite (cpe:2.3:a:openbullet:openbullet2:*) commonly deployed as a self-hosted .NET web application that loads proxies from multiple sources, including a FileProxySource component that reads proxy lists from files on disk. The root cause maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command, 'OS Command Injection'): instead of treating uploaded proxy source files as inert data, the FileProxySource path passes script files (.bat on Windows, .ps1 for PowerShell, .sh on Linux) through an execution flow whose stdout is then parsed as proxy lines, conflating data input with code execution. The related HackerNoon article also describes an auth-bypass via an empty header, which - if chained - would lower the practical privilege barrier well below the CVSS PR:L assumption.
Know when Openbullet2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
OpenBullet2 through version 0.3.2 contains a remote code execution vulnerability that allows authenticated users to execute arbitrary commands by uploading script files (.bat.ps1.sh) through the FileProxySource proxy loading feature. Attackers can upload malicious script files as proxy sources, causing the server to execute the scripts and return output as proxy lines, resulting in arbitrary command execution on the host as the process user.
Executive ViewAI
OpenBullet2 through version 0.3.2 contains a remote code execution vulnerability allowing low-privilege authenticated users to execute arbitrary OS commands on affected systems. Any organization running OpenBullet2 faces immediate risk of complete system compromise from internal or low-level external accounts. Publicly available exploit code and minimal attack complexity create high likelihood of near-term exploitation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce network segmentation restricting OpenBullet2 access to air-gapped or isolated networks; (2) Disable or remove FileProxySource functionality to prevent script upload exploitation; (3) Implement strict RBAC limiting authentication to essential users; (4) Enable file integrity monitoring and comprehensive command execution logging on affected systems to detect exploitation; (5) Monitor outbound connections for indicators of compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Openbullet2
View allAuthentication bypass in OpenBullet2 through 0.3.2 lets unauthenticated remote attackers obtain full admin access by sen
Path traversal in OpenBullet2 through 0.3.2 lets authenticated attackers read, write, and delete arbitrary files via the
Authenticated remote code execution in OpenBullet2 through version 0.3.2 allows any logged-in user to run arbitrary C# c
Credential disclosure in OpenBullet2 through 0.3.2 on Windows allows authenticated remote attackers to coerce SMB authen
Exploit-DB