CVE-2026-52872: Streambert Path Traversal Vulnerability

CVE-2026-52872 Overview

CVE-2026-52872 is a path traversal vulnerability [CWE-22] in Streambert, a cross-platform Electron desktop application for streaming and downloading video content. The flaw affects versions prior to 2.5.0. The downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle URL using the file: URI scheme. It then passes the decoded pathname to fs.copyFileSync. Because the renderer also controls downloadPath, a compromised renderer can copy any file readable by the Streambert process to an attacker-chosen writable location. The issue is fixed in version 2.5.0.

Critical Impact
A compromised renderer process can exfiltrate any file readable by Streambert and overwrite arbitrary writable files on the host.

Affected Products

Streambert Electron Desktop App versions prior to 2.5.0
Windows, macOS, and Linux builds of Streambert distributed through the upstream repository
Downstream forks that reuse src/ipc/downloads.js without patching

Discovery Timeline

2026-08-18 - CVE-2026-52872 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-52872

Vulnerability Analysis

Streambert is built on Electron, which separates a privileged main process from renderer processes that host web content. Inter-process communication (IPC) channels bridge these boundaries. The run-download IPC channel in the main process invokes downloadSubtitleFile inside src/ipc/downloads.js to fetch and save subtitle files.

The handler accepts a subtitle URL and a destination downloadPath from the renderer. When the URL uses the file: scheme, the handler decodes its pathname and passes the result directly to fs.copyFileSync. No validation confirms that the source is a legitimate remote subtitle resource, and no allowlist restricts the destination directory.

An attacker who compromises the renderer, for example through a cross-site scripting payload delivered by a malicious video source or subtitle provider, can invoke the channel with file:///etc/passwd, file:///Users/victim/.ssh/id_rsa, or any other path readable by the Streambert process. The handler copies the file into the attacker-controlled destination, which the renderer can subsequently read.

Root Cause

The root cause is missing scheme and path validation in an IPC handler that operates with main-process privileges. The design treats the renderer as trusted for both source and destination parameters and does not enforce that subtitle downloads originate from network URLs.

Attack Vector

Exploitation requires local execution context with low privileges and no user interaction. An adversary first needs code execution in the renderer, typically achieved by injecting script through untrusted subtitle metadata or a malicious streaming source. The renderer then issues an IPC message on run-download with a file: URL pointing at sensitive files and a downloadPath inside an application-writable directory. The main process copies the file, enabling read access to arbitrary local data and overwrite of writable files, which can be leveraged for persistence or configuration tampering.

See the GitHub Security Advisory GHSA-v74h-2468-rxhh for the upstream technical description.

Detection Methods for CVE-2026-52872

Indicators of Compromise

Streambert process activity that reads sensitive files such as /etc/passwd, SSH keys, browser credential stores, or user document folders outside its normal working set
New or modified files in the Streambert downloads directory that mirror the contents of system files
Unexpected writes by Streambert to configuration files, startup folders, or shell profile scripts

Detection Strategies

Hunt for fs.copyFileSync invocations in Streambert telemetry where source paths begin with file:// and target sensitive locations
Correlate Streambert file-read events against a baseline of expected subtitle and media directories
Flag Electron applications that copy files from user home subdirectories into their own download folders in short time windows

Monitoring Recommendations

Enable endpoint file-access auditing for the Streambert executable and log all reads outside its install and media directories
Monitor IPC and process behavior on developer and analyst workstations that run Electron media tools
Alert on Streambert versions below 2.5.0 discovered in software inventory scans

How to Mitigate CVE-2026-52872

Immediate Actions Required

Upgrade all Streambert installations to version 2.5.0 or later
Inventory endpoints for vulnerable Streambert builds and prioritize systems handling sensitive local data
Restrict Streambert execution to standard user accounts and avoid running it with elevated privileges

Patch Information

The maintainer fixed CVE-2026-52872 in Streambert 2.5.0. Refer to the GitHub Security Advisory GHSA-v74h-2468-rxhh for the patched commit and release notes.

Workarounds

Do not load untrusted streaming sources, subtitle providers, or plugins in Streambert versions prior to 2.5.0
Run Streambert under a dedicated low-privilege account whose file system access is confined to media directories
Apply operating system mandatory access controls, such as AppArmor or SELinux profiles, to block Streambert from reading sensitive files outside its media working set

bash

# Example AppArmor snippet restricting Streambert file access
/usr/bin/streambert {
  # Allow media and config directories
  owner @{HOME}/Videos/** rw,
  owner @{HOME}/.config/streambert/** rwk,

  # Deny sensitive locations
  deny /etc/shadow r,
  deny @{HOME}/.ssh/** r,
  deny @{HOME}/.aws/** r,
  deny @{HOME}/.gnupg/** r,
}