Streambert versions prior to 2.5.0 contain a path traversal vulnerability (CWE-22) in the downloadSubtitleFile utility accessed via the run-download IPC channel. The renderer process can supply a subtitle URL using the file: URI scheme, which is decoded and passed to fs.copyFileSync without proper path restriction. Since the renderer also controls the download destination path, an attacker with renderer access can copy arbitrary readable files to arbitrary writable locations, leading to potential data exposure and file overwrite. The vulnerability is resolved in version 2.5.0.

An attacker who can control the renderer process can exploit this vulnerability to copy any file readable by the Streambert process to a location of their choosing. This can lead to disclosure of sensitive local files and overwriting of existing writable files, resulting in confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 8.8 (high severity), reflecting local attack vector with low complexity, requiring low privileges but no user interaction, and causing high impact on confidentiality, integrity, and availability.

This vulnerability is fixed in Streambert version 2.5.0. Users should upgrade to version 2.5.0 or later to remediate this issue. No other official remediation or temporary fix is documented. Until upgrading, restricting renderer process privileges or limiting file system access may reduce risk but is not a complete mitigation.