Streambert is an Electron desktop application for streaming video content. A flaw in the downloadSubtitleFile function allows a malicious renderer to supply a file: URI, which the application decodes and copies using fs.copyFileSync. The renderer controls the destination path, so it can copy any file readable by the Streambert process into an attacker‑chosen writable location, exposing sensitive data or overwriting existing files.

This vulnerability applies to truelockmc Streambert versions earlier than 2.5.0. Users running any pre‑2.5.0 build are susceptible.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is not available, and the issue is not listed in CISA KEV. The likely attack vector involves a compromised renderer process, which may be introduced through malicious content loaded by the application. An attacker can read local files and overwrite system or user files without authentication, leading to data exfiltration and potential system compromise.