{"apiVersion":"1.0","identifier":"CVE-2026-52872","description":"Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0.","publishedAt":"2026-08-18T22:16:53","lastModifiedAt":"2026-08-19T17:19:22","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52872","cvssScore":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","epssProbability":0.00142,"riskScore":0.89,"affectedProduct":"Streambert","affectedVersions":"<2.5.0","vulnerabilityType":"Other","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-52872","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-52872","en":"https://www.redsauce.net/en/cves/CVE-2026-52872","fr":"https://www.redsauce.net/fr/cves/CVE-2026-52872","pt":"https://www.redsauce.net/pt/cves/CVE-2026-52872","de":"https://www.redsauce.net/de/cves/CVE-2026-52872","sk":"https://www.redsauce.net/sk/cves/CVE-2026-52872","el":"https://www.redsauce.net/el/cves/CVE-2026-52872"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-52872"}}