CVE-2026-25559 is a path traversal vulnerability in OpenBullet2 through version 0.3.2 affecting the wordlist endpoint. The vulnerability allows authenticated users to supply unsanitized absolute paths to the upload handler and wordlist functions, enabling arbitrary file read, write, and delete operations. By chaining file write and delete operations, attackers can achieve remote code execution by modifying critical system files such as /etc/passwd. The application runs as root by default, increasing the impact of exploitation. No official fix or patch has been confirmed as of the published date.

Exploitation of this vulnerability allows an authenticated attacker to perform arbitrary file operations on the server, including reading, writing, and deleting files. This can lead to full system compromise through remote code execution, given the application runs with root privileges. The impact is high due to the potential for complete system takeover and manipulation of critical system files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the application to trusted users only and consider running the application with least privilege to limit the impact of potential exploitation.