CVE-2026-52872: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in truelockmc streambert
CVE-2026-52872 is a path traversal vulnerability in Streambert, a cross-platform Electron desktop app for streaming and downloading video content. Versions prior to 2.5.0 have a flaw in the downloadSubtitleFile utility where a renderer process can supply a file URI and control the destination path, allowing arbitrary file copying. This can lead to exposure of sensitive local files and overwriting of writable files. The vulnerability is fixed in version 2.5.0.
AI Analysis
Technical Summary
Streambert versions before 2.5.0 contain a path traversal vulnerability (CWE-22) in the downloadSubtitleFile utility accessed via the run-download IPC channel. The renderer process can supply a subtitle URL using the file: URI scheme, and its decoded pathname is passed to fs.copyFileSync. Since the renderer also controls the destination path, a compromised renderer can copy any file readable by the Streambert process to an attacker-chosen writable location, potentially exposing sensitive data or overwriting files. This vulnerability is resolved in version 2.5.0.
Potential Impact
An attacker with renderer-level privileges can exploit this vulnerability to copy arbitrary files readable by the Streambert process to locations they control, leading to disclosure of sensitive local data and potential overwriting of existing writable files. This can result in confidentiality, integrity, and availability impacts as reflected by the CVSS score of 8.8 (high severity).
Mitigation Recommendations
This vulnerability is fixed in Streambert version 2.5.0. Users should upgrade to version 2.5.0 or later to remediate this issue. No other mitigation is indicated or required according to the available data.
CVE-2026-52872: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in truelockmc streambert
Description
CVE-2026-52872 is a path traversal vulnerability in Streambert, a cross-platform Electron desktop app for streaming and downloading video content. Versions prior to 2.5.0 have a flaw in the downloadSubtitleFile utility where a renderer process can supply a file URI and control the destination path, allowing arbitrary file copying. This can lead to exposure of sensitive local files and overwriting of writable files. The vulnerability is fixed in version 2.5.0.
CVSS v3.1
Score 8.8high
Affected software
truelockmc
streambert
pkg:github/truelockmc/streambertRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Streambert versions before 2.5.0 contain a path traversal vulnerability (CWE-22) in the downloadSubtitleFile utility accessed via the run-download IPC channel. The renderer process can supply a subtitle URL using the file: URI scheme, and its decoded pathname is passed to fs.copyFileSync. Since the renderer also controls the destination path, a compromised renderer can copy any file readable by the Streambert process to an attacker-chosen writable location, potentially exposing sensitive data or overwriting files. This vulnerability is resolved in version 2.5.0.
Potential Impact
An attacker with renderer-level privileges can exploit this vulnerability to copy arbitrary files readable by the Streambert process to locations they control, leading to disclosure of sensitive local data and potential overwriting of existing writable files. This can result in confidentiality, integrity, and availability impacts as reflected by the CVSS score of 8.8 (high severity).
Mitigation Recommendations
This vulnerability is fixed in Streambert version 2.5.0. Users should upgrade to version 2.5.0 or later to remediate this issue. No other mitigation is indicated or required according to the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-08T21:44:27.364Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a84d389c6e8be0332cafc8b
Added to database: 08/18/2026, 21:50:01 UTC
Last enriched: 09/11/2026, 10:31:51 UTC
Last updated: 10/02/2026, 02:46:05 UTC
Views: 42
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.