CVE-2026-48055

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48055", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:15:53.579Z", "datePublished": "2026-06-16T21:17:59.868Z", "dateUpdated": "2026-06-17T13:22:28.962Z"}, "containers": {"cna": {"title": "Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc"}, {"name": "https://github.com/truelockmc/streambert/releases/tag/2.5.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/truelockmc/streambert/releases/tag/2.5.0"}], "affected": [{"vendor": "truelockmc", "product": "streambert", "versions": [{"version": "< 2.5.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-16T21:17:59.868Z"}, "descriptions": [{"lang": "en", "value": "Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames during extraction, allowing a malicious archive to perform path traversal and write arbitrary files to the host filesystem. The subtitle extraction process downloads a ZIP archive and extracts its entries. The destination file path is constructed by concatenating the raw archive entry name (extracted.name) directly to the temporary directory path. If a malicious ZIP archive containing directory traversal sequences is processed, it escapes the temporary directory boundaries. The application then writes the extracted payload anywhere on the host filesystem subject to the application's current write permissions. This issue has been fixed in version 2.5.0."}], "source": {"advisory": "GHSA-3q2x-3q9p-qwfc", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-17T13:22:09.740440Z", "id": "CVE-2026-48055", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T13:22:28.962Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48055", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-17T13:22:09.740440Z"}}}], "references": [{"url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T13:21:19.185Z"}}], "cna": {"title": "Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction", "source": {"advisory": "GHSA-3q2x-3q9p-qwfc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "truelockmc", "product": "streambert", "versions": [{"status": "affected", "version": "< 2.5.0"}]}], "references": [{"url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc", "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/truelockmc/streambert/releases/tag/2.5.0", "name": "https://github.com/truelockmc/streambert/releases/tag/2.5.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames during extraction, allowing a malicious archive to perform path traversal and write arbitrary files to the host filesystem. The subtitle extraction process downloads a ZIP archive and extracts its entries. The destination file path is constructed by concatenating the raw archive entry name (extracted.name) directly to the temporary directory path. If a malicious ZIP archive containing directory traversal sequences is processed, it escapes the temporary directory boundaries. The application then writes the extracted payload anywhere on the host filesystem subject to the application's current write permissions. This issue has been fixed in version 2.5.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-16T21:17:59.868Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48055", "state": "PUBLISHED", "dateUpdated": "2026-06-17T13:22:28.962Z", "dateReserved": "2026-05-20T18:15:53.579Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-16T21:17:59.868Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "streambert", "vendor": "truelockmc", "versions": [{"status": "affected", "version": "< 2.5.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames during extraction, allowing a malicious archive to perform path traversal and write arbitrary files to the host filesystem. The subtitle extraction process downloads a ZIP archive and extracts its entries. The destination file path is constructed by concatenating the raw archive entry name (extracted.name) directly to the temporary directory path. If a malicious ZIP archive containing directory traversal sequences is processed, it escapes the temporary directory boundaries. The application then writes the extracted payload anywhere on the host filesystem subject to the application's current write permissions. This issue has been fixed in version 2.5.0."}, {"lang": "es", "value": "Streambert es una aplicaci\u00f3n de escritorio Electron multiplataforma para transmitir y descargar cualquier medio de video. En las versiones 2.4.0 y anteriores, se identific\u00f3 una vulnerabilidad Zip Slip de alta severidad en la l\u00f3gica de extracci\u00f3n de subt\u00edtulos de Streambert. La aplicaci\u00f3n no sanea los nombres de archivo de las entradas del archivo durante la extracci\u00f3n, permitiendo que un archivo malicioso realice un salto de ruta y escriba archivos arbitrarios en el sistema de archivos del host. El proceso de extracci\u00f3n de subt\u00edtulos descarga un archivo ZIP y extrae sus entradas. La ruta del archivo de destino se construye concatenando el nombre de entrada del archivo sin procesar (extracted.name) directamente a la ruta del directorio temporal. Si se procesa un archivo ZIP malicioso que contiene secuencias de salto de directorio, este escapa los l\u00edmites del directorio temporal. La aplicaci\u00f3n luego escribe la carga \u00fatil extra\u00edda en cualquier lugar del sistema de archivos del host, sujeto a los permisos de escritura actuales de la aplicaci\u00f3n. Este problema ha sido solucionado en la versi\u00f3n 2.5.0."}], "id": "CVE-2026-48055", "lastModified": "2026-10-26T12:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48055", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-17T13:22:09.740440Z", "version": "2.0.3"}}]}, "published": "2026-06-17T13:20:42.257", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/truelockmc/streambert/releases/tag/2.5.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.5.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "streambert", "source": "cna", "vendor": "truelockmc"}, "product": "streambert", "vendor": "truelockmc"}], "created": "2026-06-17T19:45:02.760072+00:00", "updated": "2026-06-20T23:05:18.089439+00:00", "vendors": ["truelockmc", "truelockmc$PRODUCT$streambert"]}