CVE-2026-52872 in Streambert
Summary
by MITRE • 08/19/2026
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in Streambert versions prior to 2.5.0 represents a critical security flaw rooted in improper input validation within the application's inter-process communication layer. As an Electron-based desktop application, Streambert relies on a main process that handles privileged operations and renderer processes that manage user interface elements. The specific weakness resides in the downloadSubtitleFile utility located in src/ipc/downloads.js, which is invoked via the run-download IPC channel. This design pattern requires strict sanitization of inputs passed from untrusted renderer contexts to the trusted main context. However, the implementation fails to adequately restrict or validate the URL scheme provided by the renderer for subtitle downloads. Specifically, it accepts URLs utilizing the file URI scheme without sufficient safeguards against path traversal or arbitrary file access patterns.
When a compromised renderer process supplies a maliciously crafted subtitle URL using the file: protocol, the application decodes the pathname and passes it directly to the Node.js fs.copyFileSync function. This function operates with the permissions of the main Streambert process, which typically runs with standard user privileges but retains full read access to files within that user's directory structure. Because the renderer also controls the downloadPath parameter, an attacker who has achieved code execution or script injection in the renderer context can dictate both the source and destination of the file copy operation. This lack of separation between untrusted input and privileged system calls creates a direct path for arbitrary file read operations.
The operational impact of this vulnerability is severe, as it allows for the exfiltration of sensitive local data stored on the victim's machine. An attacker can target configuration files containing authentication tokens, cached credentials, private keys, or other personally identifiable information accessible to the Streambert process. Furthermore, by manipulating the destination path and potentially leveraging existing writable directories, an attacker could overwrite legitimate application files or system configurations. This capability extends beyond simple data theft to include potential denial of service through file corruption or further privilege escalation if specific high-value targets are overwritten with malicious payloads that trigger on subsequent execution.
This flaw aligns closely with CWE-20 Improper Input Validation and CWE-73 External Control of File Name or Path, as the application fails to restrict input based on expected values and allows external control over file system operations. In terms of attack tactics, this vulnerability facilitates data staging and collection phases described in the MITRE ATT&CK framework, specifically under techniques related to Local Data Staging (T1560) and potentially File and Directory Information Discovery if used iteratively to map sensitive locations. The exploitation does not require complex binary exploits but rather relies on standard web-based injection or compromise of the renderer process, making it accessible to a broader range of attackers who can inject scripts into the application's UI context.
Mitigation for this vulnerability is primarily addressed through the software update mechanism provided by the vendor. Upgrading Streambert to version 2.5.0 or later resolves the issue by implementing proper validation logic within the IPC handlers, likely restricting allowed URI schemes and sanitizing file paths before they are passed to system-level functions. For organizations deploying Streambert in enterprise environments where immediate patching may not be feasible, defensive measures should include monitoring for unusual file access patterns originating from Electron renderer processes and ensuring that application sandboxing policies restrict network and filesystem permissions to the minimum necessary for functionality. Additionally, developers of similar Electron applications must enforce strict allowlists on IPC inputs and avoid passing raw user-supplied paths directly into Node.js file system APIs without rigorous validation against path traversal sequences and unauthorized URI schemes.