CVE-2026-25559

The flaw

OpenBullet2 through version 0.3.2 contains a path traversal vulnerability in the wordlist endpoint that allows authenticated attackers to perform arbitrary file read, write, and delete operations by supplying unsanitized absolute paths to t

What to do

Review advisory and patch per vendor guidance.

References

In the news

• One Empty Header to Admin: How an Auth Bypass Breaks OpenBullet2HackerNoon · 2026-06-06