EUVD-2026-62199Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L because exploitation requires local renderer compromise; PR:L for renderer-context access; S:C because arbitrary host filesystem paths are affected beyond the application boundary.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync, fs.readdirSync, and fs.unlinkSync operations without checking that it is inside an authorized backup location. A compromised renderer can choose an absolute path or a relative traversal path to create directories and write a streambert-backup-[timestamp].json file containing renderer-controlled data. The pruning loop can also delete files in that directory whose names begin with streambert-backup- and end with .json. This vulnerability is fixed in 2.6.0.
AnalysisAI
Path traversal in Streambert's Electron desktop app before version 2.6.0 allows a compromised renderer process to direct the privileged main process to create directories, write renderer-controlled JSON data, and delete files at arbitrary filesystem locations outside the intended backup directory. The vulnerable perform-scheduled-backup IPC handler in src/ipc/storage.js accepts settings.path from the renderer without validating it against an authorized backup location, enabling traversal via absolute paths or ../../-style sequences. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker has the ability to execute JavaScript within Streambert's Electron renderer process and invoke the `perform-scheduled-backup` IPC handler with a renderer-controlled `settings.path` value - for example, through an XSS or script injection vector in content rendered by the app. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.4 with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H accurately reflects the threat model. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Streambert to version 2.6.0 or later, which resolves this vulnerability via the changes introduced in pull request #149 (https://github.com/truelockmc/streambert/pull/149) and commit 43566ed031183b046675761c9813c5379b619269. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Streambert installations in your environment and identify versions prior to 2.6.0 to quantify exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today