CVE-2026-52875 Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler
A compromised renderer can exploit path traversal in the backup handler to create directories, write files, and delete specific backup files anywhere on the system.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-52875?
CVE-2026-52875 is a high-severity path traversal vulnerability in truelockmc streambert, published on 18 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync, fs.readdirSync, and fs.unlinkSync operations without checking that it is inside an authorized backup location. A compromised renderer can choose an absolute path or a relative traversal path to create directories and write a streambert-backup-[timestamp].json file containing renderer-controlled data. The pruning loop can also delete files in that directory whose names begin with streambert-backup- and end with .json. This vulnerability is fixed in 2.6.0.
Which versions are affected by CVE-2026-52875?
How do I fix CVE-2026-52875?
No fix has been published for CVE-2026-52875 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-52875 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52875 exists.
Sources
Also known as GHSA-c64m-cx97-6rc9.