CVE-2026-52872: Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Streambertto a version that resolves this vulnerability.Fixed in 2.5.0
Event History
Frequently Asked Questions
Which Streambert versions need remediation?
Systems running Streambert versions prior to 2.5.0 are affected. The issue is fixed in version 2.5.0.
What access does an attacker need to exploit this?
Exploitation requires a compromised renderer process that can send requests through the run-download IPC channel. The attacker can use the StreamBERT process's local file read permissions and write files to locations writable by that process.
What should teams do to remediate the issue?
Upgrade Streambert to version 2.5.0. The provided information does not identify an alternative mitigation for installations that cannot be upgraded immediately.
What is the likely impact of successful exploitation?
A successful exploit can copy readable local files to an attacker-chosen writable destination and overwrite existing writable files. This can expose sensitive data and affect the integrity and availability of files accessible to the application process.