CVE-2026-57565 in Readest
Summary
by MITRE • 11/04/2026
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from the authenticated user's identifier and a client-controlled fileName without rejecting path separators or parent-directory traversal. In the R2 backend, apps/readest-app/src/utils/r2.ts placed that key into a new Request URL before signing it, and URL normalization collapsed parent-directory components so the resulting presigned PUT could escape the caller's namespace. An authenticated attacker who knew a target user identifier and book hash could overwrite or poison that user's stored book object and corrupt the associated file_key metadata; the exact cross-tenant escape was verified for the R2 backend. This issue is fixed in version 0.11.10.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in Readest prior to version 0.11.10 represents a critical server-side path traversal and object storage manipulation flaw within its cloud-based book management infrastructure. The application, designed for cross-platform ebook reading, relies on an API endpoint located at apps/readest-app/src/pages/api/storage/upload.ts to handle file uploads. This specific route constructs the key used to store files in the backend Object Storage Service by concatenating the authenticated user's unique identifier with a fileName provided directly by the client. The fundamental technical flaw lies in the lack of input validation for this fileName parameter; specifically, the application fails to reject path separators or sequences indicative of parent-directory traversal such as dot-dot-slash characters. This oversight allows an attacker to manipulate the intended storage location within the cloud bucket structure rather than restricting uploads to a directory strictly associated with the authenticated user's namespace.
The operational impact is significantly amplified by how the backend service, specifically utilizing Cloudflare R2 via apps/readest-app/src/utils/r2.ts, processes these keys. When preparing for upload, the application places the constructed key into a new Request URL and signs it to generate a presigned PUT request. During this process, standard URL normalization routines are applied which collapse parent-directory components. This behavior inadvertently facilitates an escape from the caller's designated namespace. Consequently, if an attacker can predict or obtain a target user identifier along with their associated book hash, they can craft malicious file names that traverse upward in the directory hierarchy. By exploiting this mechanism, the attacker gains the ability to overwrite existing objects belonging to other tenants or inject poisoned data into shared storage locations. This constitutes a severe cross-tenant escape vulnerability where isolation boundaries between different users are effectively bypassed through object key manipulation rather than traditional network-based attacks.
From a security classification perspective, this issue aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-436 Interpretation Conflict. The ability to overwrite arbitrary objects in an Object Storage Service also relates to CWE-75 Failure to Constrain Operations within a 'Chroot' Environment when considering the logical isolation provided by user-specific prefixes. In terms of adversary tactics, this vulnerability supports techniques associated with ATT&CK T1083 File and Directory Discovery for reconnaissance or potentially T1496 Environmental Preparation if used to establish persistence through corrupted metadata files like file_key. The corruption of associated metadata further complicates recovery efforts as the application may reference invalid paths when attempting to retrieve books, leading to service degradation or data loss for legitimate users whose content has been tampered with by malicious actors exploiting this trust relationship between the client and the storage backend.
Mitigation strategies must focus on strict input validation and secure coding practices within the upload API endpoint. Developers should implement rigorous sanitization of all user-supplied file names, ensuring that path separators and traversal sequences are explicitly rejected before any concatenation with user identifiers occurs. Additionally, employing allow-listing for permitted characters in file names can further reduce the attack surface. It is also advisable to enforce canonicalization checks server-side prior to signing requests, ensuring that the final resolved path remains within the intended tenant-specific prefix regardless of URL normalization behaviors inherent in the underlying cloud provider's SDK or HTTP client libraries. Organizations utilizing versions of Readest earlier than 0.11.10 are strongly advised to upgrade immediately as this issue has been patched in version 0.11.10, restoring proper isolation boundaries and preventing unauthorized access to other users' stored book objects.