OpenBullet2 version 0.3.2 is vulnerable to a path traversal flaw in the wordlist endpoint. The flaw allows an authenticated user to supply unsanitized absolute paths to the upload handler and wordlist functions, enabling arbitrary file read, write, and delete operations. Because the application runs as root by default, an attacker can chain file write and delete primitives to overwrite critical system files such as /etc/passwd, thereby achieving remote code execution with full system compromise.

The vulnerable software is OpenBullet2 provided by the openbullet organization, specifically versions up to and including 0.3.2. Any deployment of this version that accepts authenticated requests to the wordlist endpoint is impacted.

The CVSS score of 8.7 reflects a high severity vulnerability with potential for full system compromise. The EPSS score is not available, so the current exploitation probability is uncertain, though the lack of a KEV listing suggests no documented exploitation yet. However, attackers only need to be authenticated, a condition that many users satisfy, and because path traversal can target any file on the host, the likelihood of successful exploitation is significant. The attack vector likely involves sending crafted absolute path inputs to the wordlist endpoint. Prompt remediation is essential.