Streambert versions before 2.6.0 contain a path traversal vulnerability (CWE-22) in the perform-scheduled-backup IPC handler located in src/ipc/storage.js. The handler uses a renderer-supplied path for filesystem operations (mkdirSync, writeFileSync, readdirSync, unlinkSync) without validating that the path is confined to an authorized backup directory. This flaw enables a compromised renderer to specify absolute or relative traversal paths to create or delete files outside the intended backup location, specifically files named streambert-backup-[timestamp].json. The vulnerability is resolved in version 2.6.0.

An attacker controlling the renderer process can create or delete files arbitrarily on the filesystem outside the designated backup directory. This could lead to unauthorized file manipulation, potentially affecting system integrity or availability. The CVSS 4.0 score is 8.4 (high severity), reflecting the local attack vector with low complexity but high impact on confidentiality, integrity, and availability.

Upgrade Streambert to version 2.6.0 or later, where this path traversal vulnerability is fixed. No other mitigation is indicated or required as the fix is official and addresses the root cause.