CVE-2026-48055: Streambert Path Traversal Vulnerability

CVE-2026-48055 Overview

CVE-2026-48055 is a Zip Slip path traversal vulnerability in Streambert, a cross-platform Electron desktop application used to stream and download video media. The flaw resides in the subtitle extraction logic, which fails to sanitize archive entry filenames before writing them to disk. Attackers can craft a malicious ZIP archive containing directory traversal sequences to escape the temporary extraction directory and write arbitrary files anywhere the application has write access. The issue affects Streambert versions 2.4.0 and prior, and is fixed in version 2.5.0. The vulnerability is classified under CWE-20: Improper Input Validation.

Critical Impact
Attackers can write arbitrary files to the host filesystem through a malicious subtitle ZIP archive, enabling code execution and full host compromise.

Affected Products

Streambert Electron Desktop App versions 2.4.0 and prior
Streambert subtitle extraction component
Cross-platform deployments on Windows, macOS, and Linux hosts running the vulnerable Electron build

Discovery Timeline

2026-06-17 - CVE-2026-48055 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-48055

Vulnerability Analysis

The vulnerability stems from unsafe ZIP archive extraction in Streambert's subtitle handling routine. When the application fetches a subtitle archive, it iterates over each archive entry and constructs the destination path by concatenating the raw extracted.name value directly to the temporary directory path. The code performs no validation against directory traversal characters such as ../ or absolute path prefixes.

An attacker who controls or substitutes the subtitle archive can include entries with names like ../../../../etc/cron.d/payload or ..\..\Users\Public\Start Menu\Programs\Startup\payload.lnk. During extraction, these names cause the file write operation to escape the intended temporary directory and place attacker-controlled content in sensitive system locations.

Root Cause

The root cause is missing canonicalization and validation of archive entry names before file write operations. Secure extraction requires resolving the joined destination path and verifying it remains within the intended extraction root. Streambert's logic skips this check entirely.

Attack Vector

Exploitation requires the application to process an attacker-influenced ZIP archive during subtitle retrieval. Because subtitle downloads occur over the network without user interaction beyond normal media playback, a hostile or compromised subtitle source can deliver the malicious archive. Successful write of an executable, launch agent, or scheduled task entry leads to code execution under the user account running Streambert.

No synthetic exploit code is published for this advisory. Refer to the GitHub Security Advisory GHSA-3q2x-3q9p-qwfc for vendor-confirmed technical details.

Detection Methods for CVE-2026-48055

Indicators of Compromise

Files written outside the Streambert temporary extraction directory immediately after subtitle download events.
ZIP archive entries containing ../, ..\, or absolute path prefixes in subtitle download traffic.
Unexpected new files in user autostart locations, cron directories, or application data folders following Streambert use.
Streambert process activity creating files in directories unrelated to media storage or its own working paths.

Detection Strategies

Inspect ZIP archives downloaded by Streambert and flag any entry names containing traversal sequences before extraction.
Monitor filesystem write events originating from the Streambert process and alert on writes outside its expected working directories.
Correlate subtitle download network requests with subsequent file creation events on the host to identify anomalous write paths.

Monitoring Recommendations

Enable endpoint file integrity monitoring on user autostart, scheduled task, and shell profile locations.
Log all child process creations spawned by streambert or its Electron renderer to identify post-exploitation execution.
Capture network telemetry for outbound subtitle archive downloads and retain archives for retrospective analysis.

How to Mitigate CVE-2026-48055

Immediate Actions Required

Upgrade Streambert to version 2.5.0 or later on all endpoints where the application is installed.
Inventory hosts running Streambert 2.4.0 or earlier and prioritize patching for systems with elevated user privileges.
Review filesystem audit logs for write activity by the Streambert process to locations outside its expected extraction directory.
Restrict Streambert execution to standard user accounts without administrative rights to limit the blast radius of arbitrary file writes.

Patch Information

The maintainer addressed the issue in Streambert release 2.5.0. The fix introduces validation of extracted archive entry paths so they cannot escape the designated temporary directory. Full advisory details are available in GHSA-3q2x-3q9p-qwfc.

Workarounds

Disable the subtitle download feature in Streambert until the upgrade to 2.5.0 is complete.
Block network access from Streambert hosts to untrusted subtitle providers using application or DNS filtering.
Run Streambert inside a sandbox or container with a restricted writable filesystem scope to contain arbitrary writes.

bash

# Verify installed Streambert version and upgrade path
streambert --version
# If output reports 2.4.0 or earlier, download 2.5.0 from:
# https://github.com/truelockmc/streambert/releases/tag/2.5.0