CVE-2026-52875

Name of the Vulnerable Software and Affected Versions Streambert versions prior to 2.6.0

Description The perform-scheduled-backup IPC handler in src/ipc/storage.js fails to verify if the settings.path provided by a renderer-supplied object is within an authorized backup location. This allows a compromised renderer to use absolute paths or relative traversal paths to create directories and write files named streambert-backup-[timestamp].json containing controlled data. Additionally, the pruning loop can delete files in the specified directory that start with streambert-backup- and end with .json.

Recommendations Update to version 2.6.0.