CVE-2026-52875 in Streambert
Summary
by MITRE • 08/19/2026
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync, fs.readdirSync, and fs.unlinkSync operations without checking that it is inside an authorized backup location. A compromised renderer can choose an absolute path or a relative traversal path to create directories and write a streambert-backup-[timestamp].json file containing renderer-controlled data. The pruning loop can also delete files in that directory whose names begin with streambert-backup- and end with .json. This vulnerability is fixed in 2.6.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The Streambert application, a cross-platform Electron-based desktop utility designed for streaming and downloading video content, contains a critical security flaw within its inter-process communication (IPC) architecture prior to version 2.6.0. The vulnerability resides specifically in the perform-scheduled-backup IPC handler located in the src/ipc/storage.js module. This component is responsible for managing backup operations by creating directories and writing JSON files that store application settings. However, the implementation fails to enforce strict path validation on user-supplied input before performing file system operations. Specifically, when a renderer process requests a scheduled backup, it supplies an object containing a path property which is directly passed to Node.js filesystem functions such as fs.mkdirSync, fs.writeFileSync, fs.readdirSync, and fs.unlinkSync without any sanitization or boundary checks.
This lack of validation allows for arbitrary file write operations through directory traversal attacks. A compromised renderer process, which could be exploited via cross-site scripting (XSS) vulnerabilities within the application's web views or other injection vectors, can manipulate the path parameter to specify absolute paths outside the intended backup directory structure. By utilizing relative path sequences such as ../, an attacker can navigate up the file system hierarchy and write files into sensitive directories on the host operating system. The vulnerability enables the creation of arbitrary directories and the writing of files named streambert-backup-[timestamp].json containing data controlled entirely by the renderer process. This capability effectively allows for local file overwrite attacks with potentially elevated privileges depending on the user context under which Streambert is executed.
The operational impact extends beyond simple file overwriting due to the presence of a pruning loop within the backup mechanism. This loop scans directories for files matching specific naming conventions and deletes those that begin with streambert-backup- and end with .json. An attacker can exploit this feature by pre-placing malicious JSON files in target directories or using the write capability to create them, thereby triggering their deletion during subsequent scheduled backups. This introduces a risk of arbitrary file deletion, which can lead to data loss or denial of service conditions if critical system or application configuration files are targeted. The combination of arbitrary writes and deletions significantly expands the attack surface from mere information disclosure to potential remote code execution through library injection techniques or privilege escalation via manipulation of executable paths or environment variables stored in writable locations.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. It also relates to CWE-94: Improper Control of Generation of Code (Code Injection) if the written files are executed or sourced by other processes. In terms of adversary tactics, this flaw facilitates initial access and persistence mechanisms described in the MITRE ATT&CK framework under techniques such as T1053: Scheduled Task/Job and potentially T1496: Remote File Copy depending on how the attacker leverages the written files for further exploitation stages within a compromised environment.
The vulnerability was addressed in Streambert version 2.6.0 by implementing rigorous input validation mechanisms. The fix ensures that all paths supplied via IPC handlers are resolved to absolute paths and verified against an allowlist of authorized backup directories before any file system operations are performed. Developers should ensure that path resolution occurs after sanitization checks fail, preventing directory traversal sequences from influencing the final destination. For users unable to upgrade immediately, mitigating risks involves restricting application permissions through operating-level sandboxing or user account control settings to limit write access to critical system areas. Regular audits of IPC message handlers for similar input validation gaps are recommended across Electron applications to prevent analogous path manipulation vulnerabilities in other modules.