CVE-2026-52872

Name of the Vulnerable Software and Affected Versions Streambert versions prior to 2.5.0

Description Streambert is a cross-platform Electron Desktop App used for streaming and downloading video content. The downloadSubtitleFile function in src/ipc/downloads.js, accessed via the run-download IPC channel, improperly handles subtitle URLs using the file: URI scheme. By controlling the downloadPath variable and providing a malicious URI, a compromised renderer can use fs.copyFileSync to copy any file readable by the process to an arbitrary writable location. This allows for the exfiltration of sensitive local data or the overwriting of existing writable files.

Recommendations Update to version 2.5.0.