CVE-2026-48055 Details
Description
Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames during extraction, allowing a malicious archive to perform path traversal and write arbitrary files to the host filesystem. The subtitle extraction process downloads a ZIP archive and extracts its entries. The destination file path is constructed by concatenating the raw archive entry name (extracted.name) directly to the temporary directory path. If a malicious ZIP archive containing directory traversal sequences is processed, it escapes the temporary directory boundaries. The application then writes the extracted payload anywhere on the host filesystem subject to the application's current write permissions. This issue has been fixed in version 2.5.0.
A Zip Slip vulnerability has been identified in Streambert versions through 2.4.0, specifically in the subtitle extraction process. This vulnerability arises because the application fails to properly sanitize filenames from ZIP archives during extraction. As a result, a malicious ZIP file can exploit path traversal vulnerabilities to write arbitrary files to the host filesystem, bypassing the application's designated temporary directory. The issue has been fixed in version 2.5.0.
Users can update to Streambert version 2.5.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 17, 2026CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/truelockmc/streambert/releases/tag/2.5.0 | [email protected] | Release NotesVendor |
| https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Streambert | <= 2.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |