truelockmc Streambert up to 2.4.x Subtitle Download src/ipc/downloads.js downloadSubtitleFile downloadPath path traversal

Summaryinfo

A vulnerability was found in truelockmc Streambert up to 2.4.x. It has been classified as problematic. This affects the function downloadSubtitleFile of the file src/ipc/downloads.js of the component Subtitle Download. The manipulation of the argument downloadPath leads to path traversal. This vulnerability is referenced as CVE-2026-52872. The attack can only be performed from a local environment. No exploit is available.

Detailsinfo

A vulnerability was found in truelockmc Streambert up to 2.4.x. It has been rated as problematic. This issue affects the function downloadSubtitleFile of the file src/ipc/downloads.js of the component Subtitle Download. The manipulation of the argument downloadPath with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-52872 since 06/08/2026. The exploitation is known to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

Upgrading to version 2.5.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• truelockmc

Name

• Streambert

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4

Website

• Product: https://github.com/truelockmc/streambert/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion