Read the docs
TI-2026-37974 Aliases CVE-2026-52875

Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler

Priority HIGH 78CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync, fs.readdirSync, and fs.unlinkSync operations without checking that it is inside an authorized backup location. A compromised renderer can choose an absolute path or a relative traversal path to create directories and write a streambert-backup-[timestamp].json file containing renderer-controlled data. The pruning loop can also delete files in that directory whose names begin with streambert-backup- and end with .json. This vulnerability is fixed in 2.6.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00164 5th percentileScored 2026-11-07
Fix Fixed streambert (truelockmc): 2.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
truelockmcstreambertbefore 2.6.02.6.0Patch availableCNA
  • streambert Vendortruelockmc Affected before 2.6.0 Fixed in 2.6.0 Patch available CNA

Remediation

  • Fix · CNA streambert (truelockmc) Fixed in 2.6.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-52875

References

Other 3

  • TI-2026-35498 Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler CVSS 3.1CRITICAL 10.0
  • TI-2026-35497 Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction CVSS 3.1CRITICAL 10.0
  • TI-2026-35488 Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler CVSS 4.0CRITICAL 9.3
  • TI-2026-37976 Streambert : Insecure Protocol Execution in open-external IPC Handler CVSS 3.1HIGH 8.3
  • TI-2026-37972 Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol CVSS 3.1HIGH 8.8
  • TI-2026-37973 Streambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron Renderer CVSS 3.1MEDIUM 6.9
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences