CVE-2026-25559: OpenBullet2 Path Traversal Vulnerability

CVE-2026-25559 Overview

CVE-2026-25559 is a path traversal vulnerability in OpenBullet2 through version 0.3.2. The flaw resides in the wordlist endpoint, where the upload handler and wordlist functions accept unsanitized absolute paths from authenticated users. Attackers can read, write, and delete arbitrary files on the host. Chaining the write and delete primitives produces remote code execution by manipulating critical system files such as /etc/passwd. The application runs as root by default, which extends compromise to the full operating system. The issue is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated attackers can achieve remote code execution as root by writing to or replacing critical system files through the wordlist endpoint.

Affected Products

OpenBullet2 versions up to and including 0.3.2
Deployments running the wordlist endpoint exposed over the network
Installations executing the OpenBullet2 service as the root user

Discovery Timeline

2026-06-08 - CVE-2026-25559 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-25559

Vulnerability Analysis

OpenBullet2 exposes a wordlist endpoint that accepts file paths from authenticated callers. The upload handler and wordlist functions pass these paths directly to file system APIs without normalization or containment checks. An authenticated attacker supplies an absolute path outside the intended wordlist directory and triggers arbitrary read, write, or delete operations.

The write and delete primitives combine into a remote code execution chain. An attacker deletes a sensitive system file, then writes a replacement under attacker control. Targets such as /etc/passwd, cron files, or service unit files yield code execution at the privilege level of the OpenBullet2 process.

Because OpenBullet2 runs as root in default deployments, successful exploitation produces full host compromise. The attacker can pivot to credential theft, persistence, lateral movement, or destruction of operational data. The flaw requires authentication, but separate authentication bypass research against OpenBullet2 (referenced in the Hacker Noon analysis) lowers the practical barrier to exploitation.

Root Cause

The root cause is missing input validation on user-supplied file paths in the wordlist endpoint. The application does not canonicalize paths, reject absolute paths, or constrain operations to a designated wordlist directory.

Attack Vector

The attack vector is network-based and requires low-privileged authenticated access. The attacker sends crafted HTTP requests to the wordlist endpoint with absolute paths targeting sensitive files. No user interaction is required. See the VulnCheck security advisory for endpoint specifics.

No verified public exploit code is referenced in the advisory. The vulnerability mechanism is described in prose only; consult the linked technical references for request-level detail.

Detection Methods for CVE-2026-25559

Indicators of Compromise

HTTP requests to the OpenBullet2 wordlist or upload endpoints containing absolute paths such as /etc/, /root/, /var/, or Windows paths like C:\Windows\.
Unexpected modifications to /etc/passwd, /etc/shadow, cron directories, or systemd unit files on hosts running OpenBullet2.
New or modified files under directories outside the configured OpenBullet2 wordlist storage path.
Child processes spawned by the OpenBullet2 service that are unrelated to wordlist handling.

Detection Strategies

Inspect web server and application logs for wordlist endpoint requests containing .., leading slashes, or drive letters in the path parameter.
Correlate authenticated OpenBullet2 sessions with file system changes outside the application directory using endpoint telemetry.
Alert on process executions launched by the OpenBullet2 user account that touch system configuration files.

Monitoring Recommendations

Enable file integrity monitoring on /etc/passwd, /etc/shadow, /etc/cron.*, and /etc/systemd/system/ on Linux deployments.
Capture and retain full HTTP request bodies for the OpenBullet2 API to support retrospective hunting.
Forward OpenBullet2 application logs and host audit logs to a centralized SIEM for correlation with authentication events.

How to Mitigate CVE-2026-25559

Immediate Actions Required

Restrict network access to the OpenBullet2 management interface to trusted administrators only.
Reconfigure OpenBullet2 to run under a dedicated non-root service account with minimal file system permissions.
Rotate credentials for all OpenBullet2 user accounts and review authentication logs for suspicious access.
Audit the host for unauthorized changes to system files and scheduled tasks.

Patch Information

No fixed version is referenced in the advisory at the time of NVD publication. Monitor the OpenBullet2 project repository and the VulnCheck advisory for an updated release beyond 0.3.2. Apply the patched build as soon as the maintainers publish it.

Workarounds

Place OpenBullet2 behind a reverse proxy that blocks requests containing absolute paths or .. sequences in wordlist parameters.
Run the OpenBullet2 process inside a container or chroot with read-only mounts for system directories.
Disable or firewall the wordlist upload endpoint if it is not required for the deployment.
Apply mandatory access controls such as AppArmor or SELinux profiles that restrict write access to paths outside the wordlist directory.

bash

# Example: run OpenBullet2 as a non-root user with a restricted working directory
sudo useradd -r -s /usr/sbin/nologin openbullet2
sudo chown -R openbullet2:openbullet2 /opt/openbullet2
sudo systemctl edit openbullet2.service
# Add under [Service]:
#   User=openbullet2
#   Group=openbullet2
#   ProtectSystem=strict
#   ReadWritePaths=/opt/openbullet2/UserData