CVE-2026-25559: OpenBullet2 0.3.2 Path Traversal via Wordlist Endpoint

Synopsis

A path traversal vulnerability in OpenBullet2 version 0.3.2 and earlier allows an authenticated attacker to read, write, and delete arbitrary files on the host by supplying unsanitized absolute paths to the wordlist endpoint. The vulnerability is reachable over the network and requires only a low-privilege account. By chaining the write and delete primitives against critical system files such as /etc/passwd, an attacker achieves remote code execution, with full system compromise made easier because the application runs as root by default. No fix versions have been published; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The wordlist endpoint is exposed over the network, so an attacker must be able to reach the OpenBullet2 service via HTTP/HTTPS.

• AuthenticationRequired

  A valid account is needed to reach the vulnerable endpoint, though any low-privilege account is sufficient to trigger the path traversal.

• Victim interactionNot required

  The attacker sends crafted requests directly to the API; no action from another user is needed.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or specific memory layout requirements are involved.

Blast Radius

• An attacker reads arbitrary files from the host filesystem, including credentials, private keys, and application secrets.
• An attacker writes arbitrary content to any file reachable by the process, enabling modification of /etc/passwd or other critical system files.
• An attacker deletes arbitrary files, disrupting or destroying running services and persistent data.
• Because the application runs as root by default, any of these primitives extend to full system compromise, including remote code execution via crafted file manipulation.