CVE-2026-25855

The flaw

OpenBullet2 through version 0.3.2 contains a remote code execution vulnerability that allows authenticated users to execute arbitrary commands by uploading script files (.bat.ps1.sh) through the FileProxySource proxy loading feature. Attack

What to do

Review advisory and patch per vendor guidance.

References

In the news

• One Empty Header to Admin: How an Auth Bypass Breaks OpenBullet2HackerNoon · 2026-06-06