CVE-2026-25855

Name of the Vulnerable Software and Affected Versions OpenBullet2 versions prior to 0.3.3

Description Authenticated users can achieve remote code execution by uploading malicious script files with extensions such as .bat, .ps1, or .sh. This is possible through the FileProxySource proxy loading feature, which allows the server to execute these scripts and return the output as proxy lines, leading to arbitrary command execution on the host with the privileges of the process user.

Recommendations Update to a version newer than 0.3.2. Restrict the use of the FileProxySource proxy loading feature as a temporary mitigation measure.