CVE-2026-48055

Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames during extraction, allowing a malicious archive to perform path traversal and write arbitrary files to the host filesystem. The subtitle extraction process downloads a ZIP archive and extracts its entries. The destination file path is constructed by concatenating the raw archive entry name (extracted.name) directly to the temporary directory path. If a malicious ZIP archive containing directory traversal sequences is processed, it escapes the temporary directory boundaries. The application then writes the extracted payload anywhere on the host filesystem subject to the application's current write permissions. This issue has been fixed in version 2.5.0.

• CWE-20
• CWE-22

• https://github.com/truelockmc/streambert/releases/tag/2.5.0
• https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc
• https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc

Published

Jun 17, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48048XWiki Platform is a generic wiki platform. XWiki discovered …7.5
• CVE-2026-48049@hapi/inert provides static file and directory handlers for …5.3
• CVE-2026-4805The Woostify plugin for WordPress is vulnerable to Stored Cr…6.4
• CVE-2026-48051Papra is a minimalistic document management and archiving pl…3.5
• CVE-2026-48052Papra is a minimalistic document management and archiving pl…5.4
• CVE-2026-48054OpenZeppelin Contracts Wizardis a web application to interac…8.8
• CVE-2026-48056Streambert is a cross-platform Electron Desktop App to strea…10
• CVE-2026-48058nebula-mesh is a self-hosted control plane for Slack Nebula …4.6
• CVE-2026-48059Netty is a network application framework for development of …7.5
• CVE-2026-48060Litestar is an Asynchronous Server Gateway Interface (ASGI) …8.1
• CVE-2026-48061Litestar is an Asynchronous Server Gateway Interface (ASGI) …5.9
• CVE-2026-48062CodeIgniter is a PHP full-stack web framework. Prior to 4.7.…9.8