Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience.
CVE-2026-57567
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transferfile.rs commands downloadfile and uploadfile accepted a webview-controlled filepath and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. The commands were registered in the global invoke handler for the main, updater, and reader- windows, so JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process. Exploitation requires JavaScript execution in that privileged origin, such as through an application XSS or compromised renderer; whether book-embedded JavaScript can reach the parent origin was not established. The write primitive can overwrite trusted or startup files, while the read primitive can expose keys, tokens, and application secrets. This issue is fixed in version 0.11.10.
Assessment
- CVSS
- 8.6 (v3.1)
- Severity
- High
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 4 November 2026
- Last updated
- 4 November 2026
- Assigner
- GitHub_M
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
At the source
References
- https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg
- https://github.com/readest/readest/pull/4639
- https://github.com/readest/readest/pull/4651
- https://github.com/readest/readest/commit/4025c4d7b52c8c174ec1d4c02c2a864cce249604
- https://github.com/readest/readest/commit/446c2c72de198de2dfcd63589f549ca517961d15
- https://github.com/readest/readest/releases/tag/v0.11.10
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-57567