Path Traversal in Openbullet Openbullet2
CVE-2026-25559
OpenBullet2 through version 0.3.2 contains a path traversal vulnerability in the wordlist endpoint that allows authenticated attackers to perform arbitrary file read, write, and delete operations by supplying unsanitized absolute paths to the upload handler and wordlist functions. Attackers can chain the file write and delete primitives to achieve remote code execution by manipulating critical system files such as /etc/passwd, with full system impact since the application runs as root by default.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.009 (59.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 59.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.009 · change: +0.003
Affected products
- Openbullet Openbullet2 — versions 0
Weakness classification (CWE)
References
- hackernoon.com/one-empty-header-to-admin-how-an-auth-bypass-breaks-openbullet2 (technical-description, exploit)
- www.vulncheck.com/advisories/openbullet2-path-traversal-via-wordlist-endpoint (third-party-advisory)
Frequently asked questions
- What is CVE-2026-25559?
- CVE-2026-25559 is a high-severity vulnerability in Openbullet Openbullet2, classified under Path Traversal. CVSS score: 8.8/10. Published 2026-06-08.
- How severe is CVE-2026-25559?
- High severity. CVSS v3 base score is 8.8 out of 10.