CVE-2026-52875: Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync, fs.readdirSync, and fs.unlinkSync operations without checking that it is inside an authorized backup location. A compromised renderer can choose an absolute path or a relative traversal path to create directories and write a streambert-backup-[timestamp].json file containing renderer-controlled data. The pruning loop can also delete files in that directory whose names begin with streambert-backup- and end with .json. This vulnerability is fixed in 2.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Streambertto a version that resolves this vulnerability.Fixed in 2.6.0
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Streambert installations prior to 2.6.0 are affected when a renderer process is compromised and can invoke the scheduled-backup IPC handler. The issue is in the desktop application's renderer-to-main-process IPC boundary.
What access does an attacker need to exploit it?
An attacker needs control of a renderer process or the ability to supply the renderer-controlled backup settings object. They can provide an absolute or traversal path and controlled backup data to cause filesystem operations outside the authorized backup location.
What filesystem impact is possible?
The vulnerable handler can create directories and write a timestamped streambert-backup-[timestamp].json file at an attacker-selected location. Its pruning behavior can also delete files in that location when their names start with streambert-backup- and end with .json.
What is the remediation?
Upgrade Streambert to version 2.6.0, which fixes the vulnerability.