CVE-2026-25855

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-25855

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25855.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-25855

Published

2026-06-08T16:49:34.140Z

Modified

2026-07-08T07:16:31.516867647Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenBullet2 0.3.2 Authenticated RCE via FileProxySource Script Upload

Details

OpenBullet2 through version 0.3.2 contains a remote code execution vulnerability that allows authenticated users to execute arbitrary commands by uploading script files (.bat.ps1.sh) through the FileProxySource proxy loading feature. Attackers can upload malicious script files as proxy sources, causing the server to execute the scripts and return output as proxy lines, resulting in arbitrary command execution on the host as the process user.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25855.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-78"
    ]
}

References

Affected packages

Git / github.com/openbullet/openbullet2

Affected ranges

Type

GIT

Repo

https://github.com/openbullet/openbullet2

Events

Introduced

b26bcd98ea2b73939e936bff62283811095685ff

Last affected

71654a9b19d236df7123589296d2822ad1c08685

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.2.5"
        },
        {
            "last_affected": "0.3.2"
        }
    ]
}

Affected versions

0.*

0.2.5

0.3.0

0.3.0.2586

0.3.1

0.3.1.2631

0.3.1.2637

0.3.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25855.json"