This vulnerability allows an attacker who can control the renderer process to cause Streambert to perform arbitrary file system operations. By supplying a path value to the perform‑scheduled‑backup IPC handler, the application uses that path directly for directory creation, file writing, listing, and deletion. The flaw combines a Path Traversal defect (CWE‑22) with Improper File Handling (CWE‑73), letting malicious payloads create directories, write arbitrary files, or delete files beginning with streambert‑backup- and ending with .json.

All releases of truelockmc's Streambert built prior to version 2.6.0 are affected. The issue resides in the perform‑scheduled‑backup IPC handler within src/ipc/storage.js and applies across all operating systems supported by the Electron Desktop App, including Windows, macOS, and Linux.

The CVSS score of 8.4 classifies the flaw as high impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a compromised renderer running inside the application, meaning the attack is local to the host but can affect any user who can inject code into the renderer. The lack of path validation grants attackers the ability to write or delete arbitrary files on the host file system using the application's privileges, potentially resulting in data loss or corruption of application data.