Loading story…
Streambert fixed a critical arbitrary file write flaw in version 2.5.0 after maintainers disclosed multiple security issues, including GHSA-3q2x-3q9p-qwfc. The vulnerability affects Streambert 2.4.0 and earlier, where subtitle extraction in src/ipc/subtitles.js concatenates ZIP entry names into a temporary path without sanitization, allowing path traversal during archive extraction. The issue was reported by jeremyHOT and fixed with the 2.5.0 release.
The flaw, tracked as CVE-2026-48055, allows a malicious subtitle ZIP archive delivered through Streambert’s subtitle download workflow to escape the intended temporary directory and write files anywhere permitted by the application’s privileges. The advisory links exploitation to the get-subtitle-url IPC channel and recommends sanitizing extracted filenames, while public vulnerability records rate the bug CVSS 10.0 and describe it as remotely exploitable. Users are advised to upgrade to Streambert 2.5.0 immediately.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-16, CVE-2026-48055 was published for the Streambert arbitrary file write vulnerability in subtitle extraction. The entry rates the issue critical with a CVSS 3.1 score of 10.0 and identifies Streambert 2.5.0 as the fixed version.
On 2026-05-22, a GitHub security advisory disclosed a high-severity arbitrary file write (Zip Slip) vulnerability in Streambert affecting versions up to 2.4.0. The advisory says the issue was patched in version 2.5.0 and includes technical details and a proof of concept involving malicious subtitle ZIP archives.
On 2026-05-22, truelockmc released Streambert version 2.5.0. The release notes state that it fixes three critical vulnerabilities, including GHSA-3q2x-3q9p-qwfc, with fixes credited to jeremyHOT and truelockmc.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Jellyfin disclosed **CVE-2026-48793**, a high-severity flaw affecting versions earlier than `10.11.10`, in which subtitle conversion code passes an unescaped subtitle file path into FFmpeg command-line arguments. On Linux, a specially crafted subtitle filename containing double quotes can break argument quoting and inject arbitrary FFmpeg options through `SubtitleEncoder.ConvertTextSubtitleToSrtInternal`, exposing a vulnerability class previously seen in related Jellyfin issues. The vulnerable code path is reachable without authentication through `SubtitleController.GetSubtitle`, and an attacker who can place a file in a Jellyfin media library directory—such as through a shared NAS, Samba share, or guest upload workflow—could trigger **arbitrary file write** on the server and **information disclosure**. The issue carries a CVSS v3.1 score of **8.8**, was reported by Alister MacCormack, and has been fixed in Jellyfin `10.11.10`; administrators are advised to upgrade and restrict untrusted file placement in media library paths.
Jun 29, 2026
A high-severity directory traversal flaw, **CVE-2026-17524**, has been disclosed in the `zip-lib` package before version `1.1.0`, allowing attackers to bypass extraction safeguards and write files outside the intended destination folder. The bug stems from cached path-validation results during archive extraction: `zip-lib` checks the `isOutsideTargetFolder` condition only when an initial directory symlink is created, enabling later archive entries to evade traversal protections. The issue is mapped to **CWE-22** and carries a **CVSS 3.1** score reflecting network-exploitable impact with high confidentiality risk. The vulnerability fits the long-running **Zip Slip** class of archive extraction bugs, in which crafted archive entries such as `../../` paths can overwrite arbitrary files and potentially lead to remote code execution across ZIP, TAR, JAR, CPIO, and other formats. Security research has shown this pattern affects thousands of projects across multiple ecosystems when extraction logic concatenates archive entry names without robust validation, and offensive testing tools such as **Archive Pwn** have made it easier to generate malicious archives using traversal paths, symlink abuse, Unicode tricks, and other bypass techniques. The `zip-lib` disclosure underscores that archive handling remains a persistent software supply chain and application security risk even years after the original Zip Slip wave of fixes.
Jul 29, 2026
Two high-severity vulnerabilities in the widely used open-source compression utility 7-Zip have been disclosed, allowing attackers to achieve remote code execution by leveraging specially crafted ZIP archives. The flaws, identified as CVE-2025-11001 and CVE-2025-11002, were reported by Trend Micro’s Zero Day Initiative and affect multiple builds of 7-Zip. These vulnerabilities arise from improper parsing of symbolic links within ZIP files, enabling a malicious archive to escape its intended extraction directory and write files to arbitrary locations on the victim’s system. If exploited, this directory traversal can be chained to execute arbitrary code with the privileges of the user running 7-Zip, potentially compromising the entire Windows environment. Both vulnerabilities have been assigned a CVSS base score of 7.0, reflecting their significant risk. Exploitation requires minimal user interaction; simply opening or extracting a malicious ZIP file is sufficient to trigger the attack. The vulnerabilities were quietly patched in 7-Zip version 25.00, released on July 5, 2025, but details were not publicly disclosed until October, leaving users unaware and exposed for several months if they had not updated. The lack of an automatic update mechanism in 7-Zip exacerbates the risk, as many users may not be running the latest, patched version. The vulnerabilities specifically allow attackers to overwrite or plant payloads in sensitive system paths, which can be used to hijack execution flow and escalate privileges. Security advisories emphasize the importance of updating to version 25.00 or later to mitigate these risks. The flaws highlight the ongoing challenges in securing widely deployed open-source tools, especially those lacking robust update mechanisms. Organizations relying on 7-Zip for file compression and extraction should prioritize patching and consider additional controls to limit the impact of potential exploitation. The vulnerabilities underscore the need for user awareness regarding the risks of opening files from untrusted sources. Security researchers warn that similar directory traversal and symlink handling issues may exist in other archiving tools, warranting broader scrutiny. The incident demonstrates the value of coordinated vulnerability disclosure and timely patch adoption. Enterprises are advised to audit their environments for outdated 7-Zip installations and deploy the latest version as a matter of urgency. The disclosure also serves as a reminder for software maintainers to implement secure default behaviors and consider automated update features to protect end users.
Jul 12, 2026