CVE-2026-25559 is a path traversal vulnerability in OpenBullet2 (up to version 0.3.2) affecting the wordlist endpoint. Authenticated attackers can supply unsanitized absolute paths to the upload handler and wordlist functions, enabling arbitrary file read, write, and delete operations. By chaining file write and delete actions, attackers can achieve remote code execution, including modification of critical system files such as /etc/passwd. The application runs with root privileges by default, increasing the potential impact. No official patch or remediation level has been provided as of the published date.

The vulnerability allows authenticated attackers to perform arbitrary file operations, including reading, writing, and deleting files on the host system. This can lead to remote code execution and full system compromise due to the application running as root. The CVSS 4.0 score of 8.7 reflects high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the application to trusted users only and consider running the application with least privilege instead of root to reduce impact. Monitor vendor channels for updates and apply patches promptly once released.