CVE-2026-52875: Streambert Path Traversal Vulnerability

CVE-2026-52875 Overview

CVE-2026-52875 is a path traversal vulnerability [CWE-22] in Streambert, a cross-platform Electron desktop application for streaming and downloading video content. The perform-scheduled-backup IPC handler in src/ipc/storage.js accepts a settings.path value from a renderer-supplied object and uses it directly for filesystem operations. A compromised renderer can supply an absolute path or a traversal sequence to create directories and write attacker-controlled JSON files anywhere the process can reach. The pruning logic can also delete files whose names match the backup pattern. Versions prior to 2.6.0 are affected.

Critical Impact
A compromised renderer process can write attacker-controlled data and delete matching JSON files outside the intended backup directory, enabling local file tampering and integrity loss.

Affected Products

Streambert Electron Desktop Application versions prior to 2.6.0
src/ipc/storage.jsperform-scheduled-backup IPC handler
Deployments on any operating system where Streambert runs (Windows, macOS, Linux)

Discovery Timeline

2026-08-18 - CVE-2026-52875 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-52875

Vulnerability Analysis

Streambert exposes an Inter-Process Communication (IPC) handler named perform-scheduled-backup from the Electron main process. The handler reads settings.path from an object supplied by the renderer and passes it directly to fs.mkdirSync, fs.writeFileSync, fs.readdirSync, and fs.unlinkSync. The handler does not verify that the resolved path lies inside an authorized backup directory. A renderer that has been compromised through cross-site scripting, a malicious extension, or a supply chain issue can therefore influence filesystem operations executed with the privileges of the main process.

The handler writes a file named streambert-backup-[timestamp].json containing renderer-controlled data. Its pruning loop then enumerates the target directory and deletes any file matching the streambert-backup-*.json pattern, allowing removal of legitimate files that happen to match this name in an attacker-selected location.

Root Cause

The root cause is missing path validation on IPC input. The trust boundary between the renderer and main processes is not enforced for the backup path parameter, so untrusted input reaches privileged Node.js filesystem APIs without canonicalization or allowlist checks [CWE-22].

Attack Vector

Exploitation requires a compromised or malicious renderer process with the ability to invoke the vulnerable IPC channel. The attacker sends a crafted settings object containing an absolute path or a relative traversal sequence such as ../../. The main process resolves the path and performs directory creation, file writing, directory listing, and file deletion at the attacker-chosen location.

javascript

// Patch in src/ipc/storage.js - Streambert 2.6.0
const backupDir = settings.path;
if (!backupDir) return { ok: false, error: "No backup path set" };

// Before: backupDir used directly without resolution
// fs.mkdirSync(backupDir, { recursive: true });

// After: path is resolved before use
const resolvedDir = path.resolve(backupDir);
fs.mkdirSync(resolvedDir, { recursive: true });

const timestamp = new Date()
  .toISOString()
  .replace(/[:.]/g, "-")
  .slice(0, 19);
const filename = `streambert-backup-${timestamp}.json`;
const fullPath = path.join(resolvedDir, filename);
fs.writeFileSync(fullPath, JSON.stringify(/* ... */));
// Source: [GitHub Commit 43566ed](http://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269)

Detection Methods for CVE-2026-52875

Indicators of Compromise

Files named streambert-backup-[timestamp].json appearing outside the configured backup directory
Unexpected deletion of .json files whose names begin with streambert-backup- in user or system directories
New directories created by the Streambert process in unusual filesystem locations

Detection Strategies

Inventory installed Streambert instances and flag any build with a version below 2.6.0
Monitor process telemetry for streambert writing to paths outside the user-configured backup directory
Review Electron IPC audit logs, where available, for perform-scheduled-backup invocations containing absolute paths or .. sequences

Monitoring Recommendations

Enable file integrity monitoring for user profile, application data, and system configuration directories on hosts running Streambert
Alert on filesystem writes and unlinks by the Streambert process outside its expected working directories
Correlate Streambert filesystem activity with renderer-level anomalies such as unexpected network connections or script execution

How to Mitigate CVE-2026-52875

Immediate Actions Required

Upgrade all Streambert installations to version 2.6.0 or later without delay
Audit configured backup paths and confirm they point to directories under user control only
Review recent filesystem activity for files matching streambert-backup-*.json outside the intended backup location

Patch Information

The issue is fixed in Streambert 2.6.0. The fix, published in GitHub Pull Request #149 and commit 43566ed, calls path.resolve on the supplied backup path before use and tightens filesystem operations. Full details are in the GitHub Security Advisory GHSA-c64m-cx97-6rc9.

Workarounds

If upgrading immediately is not possible, disable scheduled backups in Streambert settings to prevent invocation of the vulnerable IPC handler
Run Streambert under a least-privileged local account to limit the filesystem scope reachable by the main process
Restrict which users can modify Streambert configuration files to reduce the risk of a malicious settings.path value being persisted

bash

# Verify installed Streambert version is 2.6.0 or later
streambert --version

# Example: locate stray backup files written outside the expected directory (Linux/macOS)
find / -name 'streambert-backup-*.json' -not -path '/home/*/Backups/*' 2>/dev/null