CVE-2026-25855 Overview
CVE-2026-25855 is an authenticated remote code execution vulnerability in OpenBullet2 through version 0.3.2. The flaw resides in the FileProxySource proxy loading feature, which accepts script files with extensions such as .bat, .ps1, and .sh as proxy sources. When an authenticated user uploads a malicious script as a proxy source, the server executes the script and returns its output as proxy lines. This grants attackers arbitrary command execution on the host under the privileges of the OpenBullet2 process. The vulnerability is classified under CWE-78, OS Command Injection.
Critical Impact
Authenticated attackers can execute arbitrary operating system commands on the OpenBullet2 host, leading to full compromise of the application server.
Affected Products
- OpenBullet2 versions through 0.3.2
- Deployments exposing the FileProxySource proxy loading feature
- Hosts running OpenBullet2 on Windows or Linux where script interpreters are available
Discovery Timeline
- 2026-06-08 - CVE-2026-25855 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-25855
Vulnerability Analysis
OpenBullet2 supports loading proxy lists from multiple source types, including file-based sources handled by FileProxySource. The feature reads a referenced file and returns its content as proxy entries. The implementation does not restrict file extensions or content type before passing the file to the host execution context. When a file with a script extension such as .bat, .ps1, or .sh is referenced, the server executes the script rather than reading it as text. The standard output is then parsed and returned as proxy lines to the caller.
Authenticated users with permission to configure proxy sources can leverage this behavior to run arbitrary commands. The process executes commands using the same user context as the OpenBullet2 service, which is commonly a privileged service account in self-hosted deployments. Combined with the authentication bypass weakness documented in the HackerNoon Auth Bypass Analysis, unauthenticated attackers may reach this code path in vulnerable configurations.
Root Cause
The root cause is improper input validation in the FileProxySource handler. The component treats script files as executable inputs instead of plain text proxy lists. There is no extension allowlist, no MIME validation, and no sandboxing of the file processing routine, satisfying the conditions described by CWE-78.
Attack Vector
An authenticated attacker uploads or references a script file through the proxy source configuration. The OpenBullet2 server invokes the host shell or interpreter to execute the script. Attackers embed arbitrary commands inside the script body to achieve code execution. The output of the executed commands is returned in the proxy list response, providing direct command output exfiltration. Full technical details are available in the VulnCheck OpenBullet2 RCE Advisory.
Detection Methods for CVE-2026-25855
Indicators of Compromise
- Presence of .bat, .ps1, or .sh files inside OpenBullet2 proxy source directories
- Child processes spawned by the OpenBullet2 service such as cmd.exe, powershell.exe, bash, or sh
- HTTP requests to OpenBullet2 endpoints that configure or reload FileProxySource entries with script extensions
- Outbound network connections originating from the OpenBullet2 process to attacker-controlled hosts
Detection Strategies
- Monitor process trees for the OpenBullet2 worker spawning shell or interpreter processes, which is anomalous behavior for a proxy loader.
- Inspect filesystem write events targeting proxy source directories for files with executable script extensions.
- Correlate authentication events with proxy source configuration changes to detect privilege misuse.
Monitoring Recommendations
- Enable command-line auditing for processes launched by the OpenBullet2 service account.
- Log all HTTP requests that mutate proxy source configuration and alert on extensions outside the expected allowlist.
- Forward host telemetry and OpenBullet2 application logs to a centralized analytics platform for retroactive hunting.
How to Mitigate CVE-2026-25855
Immediate Actions Required
- Restrict network access to OpenBullet2 management interfaces to trusted operators only.
- Audit existing proxy source configurations and remove any entries pointing to script-extension files.
- Run the OpenBullet2 service under a least-privilege account with no shell access where feasible.
- Rotate credentials and API tokens that may have been exposed on hosts running affected versions.
Patch Information
No fixed version has been published in the NVD record at the time of disclosure. Operators should monitor the VulnCheck OpenBullet2 RCE Advisory and the official OpenBullet2 repository for an upstream patch addressing the FileProxySource handler.
Workarounds
- Disable the FileProxySource feature if not required by the workflow.
- Apply filesystem-level controls that block execution of .bat, .ps1, and .sh files inside OpenBullet2 working directories.
- Place OpenBullet2 behind a reverse proxy that enforces strong authentication and IP allowlisting.
- Run the application inside an isolated container with no interactive shell binaries available on PATH.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
