CVE-2026-52875
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Vulnerability in Streambert (before 2.6.0) in the perform-scheduled-backup IPC handler, which uses a renderer-supplied path for file operations without checking if it is in an authorized location. A compromised renderer can create directories, write files, and delete files anywhere.
Risk Assessment
An attacker can write and delete files on the system, potentially leading to data integrity compromise or system damage.
Recommendation
Update Streambert to version 2.6.0 or later. Validate paths supplied by the renderer.
Original NVD description (English source)
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync, fs.readdirSync, and fs.unlinkSync operations without checking that it is inside an authorized backup location. A compromised renderer can choose an absolute path or a relative traversal path to create directories and write a streambert-backup-[timestamp].json file containing renderer-controlled data. The pruning loop can also delete files in that directory whose names begin with streambert-backup- and end with .json. This vulnerability is fixed in 2.6.0.