EUVD-2026-37500Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Network-delivered archive but victim must trigger subtitle extraction (UI:R); no auth needed; arbitrary file write yields high integrity/availability and limited confidentiality via dropped code, scope unchanged within user context.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames during extraction, allowing a malicious archive to perform path traversal and write arbitrary files to the host filesystem. The subtitle extraction process downloads a ZIP archive and extracts its entries. The destination file path is constructed by concatenating the raw archive entry name (extracted.name) directly to the temporary directory path. If a malicious ZIP archive containing directory traversal sequences is processed, it escapes the temporary directory boundaries. The application then writes the extracted payload anywhere on the host filesystem subject to the application's current write permissions. This issue has been fixed in version 2.5.0.
AnalysisAI
Arbitrary file write in Streambert Electron desktop app (versions ≤2.4.0) allows remote attackers to drop files anywhere the app process can write by serving a malicious subtitle ZIP archive. The subtitle extraction routine concatenates raw archive entry names to the destination path without sanitization, enabling classic Zip Slip path traversal that can be escalated to code execution by overwriting startup or configuration files. No public exploit identified at time of analysis, but the upstream advisory (GHSA-3q2x-3q9p-qwfc) and fix in v2.5.0 confirm the issue.
Technical ContextAI
Streambert is a cross-platform Electron application (truelockmc/streambert per CPE) that downloads subtitle archives during media playback and extracts them to a temporary directory. The root cause is CWE-20 (Improper Input Validation), specifically the well-known Zip Slip pattern: the extractor builds the output path as path.join(tempDir, entry.name) without verifying that the resolved path remains inside tempDir. Crafted entries containing ../ sequences (or absolute paths on some extractors) escape the intended boundary, letting the archive write to any location the Node.js/Electron process can reach - which on a desktop install typically includes the user's home directory, app resources, and autostart locations.
RemediationAI
Upgrade to Streambert 2.5.0 or later, released at https://github.com/truelockmc/streambert/releases/tag/2.5.0, which contains the fix credited to @jeremyHOT and @truelockmc per the advisory at https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc. If immediate upgrade is not possible, avoid loading subtitles from untrusted media sources or third-party indexers (this disables a core convenience feature), block outbound network access from the Streambert process to non-allowlisted subtitle providers at the host firewall, and run the application under a low-privilege user account so any successful traversal is confined to that account's writable paths rather than system locations.
More in Streambert
View allLocal arbitrary binary execution in Streambert, a cross-platform Electron desktop app for streaming and downloading vide
Remote code execution in Streambert (Electron desktop streaming/download app) versions before 2.5.0 lets a compromised r
Same weakness CWE-20 – Improper Input Validation
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today