Streambert’s subtitle extraction process does not sanitize archive entry filenames, creating a classic Zip Slip condition. A crafted ZIP that contains directory traversal sequences can override the temporary directory boundary and write files anywhere on the host filesystem, subject to the privileges of the running application. Such arbitrary file writes damage integrity, allow modification or creation of critical system files, and can lead to full compromise of the host if the application runs with elevated rights.

The flaw exists in Truelockmc Streambert versions 2.4.0 and earlier, all of which are cross‑platform Electron desktop applications. The issue was remedied in release 2.5.0, which can be downloaded from the project’s GitHub releases page.

The CVSS score of 10 indicates the highest severity, although the EPSS score of <1% suggests a currently low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must supply a malicious ZIP archive to the subtitle extraction routine, which could be achieved through social engineering, spear‑phishing, or exploiting abnormal subtitle downloads. Because the extracted files are written with the application's own permissions, an attacker could overwrite executables or inject malicious payloads, potentially leading to remote code execution on the victim’s machine.