SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-52872

HIGH · CVSS 8.8 EPSS 0.19% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-18 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The Streambert Electron Desktop App versions prior to 2.5.0 are vulnerable due to a flaw in the downloadSubtitleFile utility, which allows a compromised renderer to manipulate file paths and copy sensitive local files to attacker-specified locations. This could lead to unauthorized access to sensitive data and the potential overwriting of existing files. Organizations using affected versions should prioritize upgrading to version 2.5.0 to mitigate these risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-52872
Severity
HIGH
CVSS
8.8
EPSS
0.19%

Original NVD Description

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0.