CVE-2026-25559

Name of the Vulnerable Software and Affected Versions OpenBullet2 versions prior to 0.3.3

Description A path traversal issue exists in the wordlist endpoint. Authenticated attackers can perform arbitrary file read, write, and delete operations by providing unsanitized absolute paths to the upload handler and wordlist functions. By manipulating critical system files such as /etc/passwd, these primitives can be chained to achieve remote code execution. The impact is severe because the application typically runs with root privileges.

Recommendations Update OpenBullet2 to a version newer than 0.3.2. Restrict access to the wordlist endpoint to minimize the risk of exploitation.