CVE-2026-25855: OpenBullet2 0.3.2 Authenticated RCE via FileProxySource Script Upload

Synopsis

Remote code execution vulnerability in OpenBullet2 versions through 0.3.2, reachable over the network by any authenticated user. An attacker with a low-privilege account can upload a malicious script file (.bat, .ps1, or .sh) through the FileProxySource proxy loading feature, causing the server to execute the script and return output as proxy lines. Successful exploitation gives the attacker arbitrary command execution on the host as the process user. No fix versions have been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the OpenBullet2 service over the network; the vulnerable endpoint is exposed via its standard web interface.

• AuthenticationRequired

  Any low-privilege account is sufficient; no elevated or administrative credentials are needed to reach the FileProxySource upload feature.

• Victim interactionNot required

  No victim action is needed; the attacker submits the malicious script directly and the server executes it without any user involvement.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions, memory layout dependencies, or other environmental factors required.

Blast Radius

• The attacker executes arbitrary OS commands on the host as the process user running OpenBullet2.
• The attacker reads files and environment variables accessible to the process user, including credentials, configuration files, and API keys stored on disk.
• The attacker modifies or deletes files within the reach of the process user, including application data and proxy configuration.
• The attacker can disrupt the availability of the OpenBullet2 service by terminating processes or corrupting application state.