CVE-2026-52872

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/truelockmc/streambert/security/advisories/GHSA-v74h-2468-rxhh
https://github.com/truelockmc/streambert/security/advisories/GHSA-v74h-2468-rxhh

Configurations

No configuration.

History

22 Oct 2026, 17:09

Type	Values Removed	Values Added
Summary		(es) Streambert es una aplicación de escritorio Electron multiplataforma para transmitir y descargar contenido de video. Antes de la versión 2.5.0, la utilidad downloadSubtitleFile en src/ipc/downloads.js, a la que se accede a través del canal IPC run-download, acepta una URL de subtítulos proporcionada por el renderizador utilizando el esquema URI file: y pasa su nombre de ruta decodificado a fs.copyFileSync. El renderizador también controla downloadPath, que determina la ruta de destino. Un renderizador comprometido puede, por lo tanto, copiar cualquier archivo legible por el proceso StreamBERT en una ubicación escribible elegida por el atacante, exponiendo datos locales sensibles, y puede sobrescribir archivos escribibles existentes. Esta vulnerabilidad está corregida en la versión 2.5.0.

Information

Published : 2026-08-18 22:16

Updated : 2026-10-22 17:09

NVD link : CVE-2026-52872

Mitre link : CVE-2026-52872

CVE.ORG link : CVE-2026-52872

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-73

External Control of File Name or Path

{"id": "CVE-2026-52872", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52872", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-19T16:47:03.535748Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "truelockmc", "product": "streambert", "versions": [{"status": "affected", "version": "< 2.5.0"}]}]}], "published": "2026-08-18T22:16:53.650", "references": [{"url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-v74h-2468-rxhh", "source": "security-advisories@github.com"}, {"url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-v74h-2468-rxhh", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0."}, {"lang": "es", "value": "Streambert es una aplicaci\u00f3n de escritorio Electron multiplataforma para transmitir y descargar contenido de video. Antes de la versi\u00f3n 2.5.0, la utilidad downloadSubtitleFile en src/ipc/downloads.js, a la que se accede a trav\u00e9s del canal IPC run-download, acepta una URL de subt\u00edtulos proporcionada por el renderizador utilizando el esquema URI file: y pasa su nombre de ruta decodificado a fs.copyFileSync. El renderizador tambi\u00e9n controla downloadPath, que determina la ruta de destino. Un renderizador comprometido puede, por lo tanto, copiar cualquier archivo legible por el proceso StreamBERT en una ubicaci\u00f3n escribible elegida por el atacante, exponiendo datos locales sensibles, y puede sobrescribir archivos escribibles existentes. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.5.0."}], "lastModified": "2026-10-22T17:09:59.477", "sourceIdentifier": "security-advisories@github.com"}