A path traversal vulnerability in the truelockmc Streambert application allows local authenticated users to read or write arbitrary files on the host system.

The application is susceptible to path traversal (CWE-22) and improper control of file paths (CWE-73), which can be exploited by an authenticated local user to bypass directory restrictions.

Successful exploitation of this flaw allows an attacker to access sensitive data stored on the host or potentially overwrite critical configuration files. With a CVSS score of 8.8, this vulnerability poses a significant risk to the integrity and confidentiality of the host system, as it grants elevated control over the filesystem.

Immediate Action: Update the Streambert desktop application to version 2.5.0 or later to include the necessary path validation fixes.

Proactive Monitoring: Review file access logs for unexpected read or write attempts originating from the application process, particularly those targeting system configuration directories.

Compensating Controls: Ensure the application is executed with the least privilege necessary to limit the potential impact of file system access if the process is compromised.

Public Exploit Available: No

Given the high severity of this vulnerability, users should prioritize updating their Streambert installation to the latest version immediately. Failure to patch could allow local actors to compromise sensitive data and escalate their access within the host environment.