CVE-2026-52872

Received Received - Intake

Arbitrary File Copy Vulnerability in StreamBERT Electron App

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-52872

Affected Vendors & Products

Vendor	Product	Version / Range
streambert	streambert	2.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability in Streambert (before version 2.5.0) allows a compromised renderer to exploit the downloadSubtitleFile utility. The renderer can supply a file: URI scheme URL for a subtitle file, which is then passed to fs.copyFileSync. Since the renderer also controls the download path, it can copy any file readable by Streambert to an attacker-chosen location or overwrite existing files.

Detection Guidance

To detect this vulnerability, check if your StreamBERT version is below 2.5.0. Run the command: streambert --version. If the version is older, the system is vulnerable.

Impact Analysis

An attacker could access sensitive local data by copying files readable by Streambert to a location they control. They could also overwrite important files, potentially causing system instability or data loss. This requires a compromised renderer, such as through malicious code injection.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using Streambert may face compliance breaches if sensitive data is exposed or altered due to this flaw.

Mitigation Strategies

Update StreamBERT to version 2.5.0 or later immediately. This fixes the file: URI scheme handling issue in the downloadSubtitleFile utility.

Hi! I’m here to help you understand CVE-2026-52872. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70