CVE-2026-52875

Received Received - Intake

Path Traversal in Streambert Desktop App

Publication date: 2026-08-18

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync, fs.readdirSync, and fs.unlinkSync operations without checking that it is inside an authorized backup location. A compromised renderer can choose an absolute path or a relative traversal path to create directories and write a streambert-backup-[timestamp].json file containing renderer-controlled data. The pruning loop can also delete files in that directory whose names begin with streambert-backup- and end with .json. This vulnerability is fixed in 2.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-25

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-52875

Affected Vendors & Products

Vendor	Product	Version / Range
streambert	streambert	2.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability affects Streambert, an Electron app for streaming and downloading videos. Before version 2.6.0, the app's backup feature did not properly validate the directory path provided by the renderer process. A malicious renderer could specify an absolute or relative path outside the intended backup location, allowing it to create directories and write files named streambert-backup-[timestamp].json with arbitrary data. It could also delete files in that directory with names starting with streambert-backup- and ending with .json.

Detection Guidance

Check for unauthorized backup files named streambert-backup-[timestamp].json in directories outside the intended backup location. Inspect file system operations for unexpected directory creation or file writes in sensitive paths.

Impact Analysis

If exploited, this vulnerability could allow an attacker to write malicious files to arbitrary locations on your system or delete important files in the specified directory. This could lead to data loss, system instability, or further compromise if the attacker gains control over backup files.

Compliance Impact

This vulnerability could lead to unauthorized file creation and deletion outside intended backup directories, potentially violating data integrity and access control requirements under GDPR and HIPAA. A compromised renderer could write sensitive data to arbitrary locations or delete critical files, undermining compliance with data protection and audit logging mandates.

Mitigation Strategies

Upgrade Streambert to version 2.6.0 or later to address the vulnerability. If upgrading is not possible, restrict renderer permissions and validate all file paths to ensure they remain within authorized backup directories.

Hi! I’m here to help you understand CVE-2026-52875. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70