CVE-2026-48055

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-48055

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48055.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-48055

Aliases

GHSA-3q2x-3q9p-qwfc

Published

2026-06-16T21:17:59.868Z

Modified

2026-07-09T04:02:28.533250033Z

Severity

10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H CVSS Calculator

Summary

Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction

Details

Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames during extraction, allowing a malicious archive to perform path traversal and write arbitrary files to the host filesystem. The subtitle extraction process downloads a ZIP archive and extracts its entries. The destination file path is constructed by concatenating the raw archive entry name (extracted.name) directly to the temporary directory path. If a malicious ZIP archive containing directory traversal sequences is processed, it escapes the temporary directory boundaries. The application then writes the extracted payload anywhere on the host filesystem subject to the application's current write permissions. This issue has been fixed in version 2.5.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48055.json",
    "cwe_ids": [
        "CWE-20",
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/truelockmc/streambert

Affected ranges

Type

GIT

Repo

https://github.com/truelockmc/streambert

Events

Introduced

Fixed

a93c8bd99b8070eb9cfda9140c445bf27ffc4bdc

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.5.0"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48055.json"