CVE-2026-52872

{
  "id": "CVE-2026-52872",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T22:16:53.650",
  "lastModified": "2026-10-22T17:09:59.477",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0."
    },
    {
      "lang": "es",
      "value": "Streambert es una aplicación de escritorio Electron multiplataforma para transmitir y descargar contenido de video. Antes de la versión 2.5.0, la utilidad downloadSubtitleFile en src/ipc/downloads.js, a la que se accede a través del canal IPC run-download, acepta una URL de subtítulos proporcionada por el renderizador utilizando el esquema URI file: y pasa su nombre de ruta decodificado a fs.copyFileSync. El renderizador también controla downloadPath, que determina la ruta de destino. Un renderizador comprometido puede, por lo tanto, copiar cualquier archivo legible por el proceso StreamBERT en una ubicación escribible elegida por el atacante, exponiendo datos locales sensibles, y puede sobrescribir archivos escribibles existentes. Esta vulnerabilidad está corregida en la versión 2.5.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "truelockmc",
          "product": "streambert",
          "versions": [
            {
              "version": "< 2.5.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-19T16:47:03.535748Z",
          "id": "CVE-2026-52872",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-v74h-2468-rxhh",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-v74h-2468-rxhh",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}