Readest up to 0.11.9 File Transfer transfer_file.rs download_file/upload_file file_path path traversal

Summaryinfo

A vulnerability was found in Readest up to 0.11.9. It has been rated as critical. This affects the function download_file/upload_file of the file apps/readest-app/src-tauri/src/transfer_file.rs of the component File Transfer. This manipulation of the argument file_path causes path traversal. This vulnerability appears as CVE-2026-57567. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in Readest up to 0.11.9. Affected by this vulnerability is the function download_file/upload_file of the file apps/readest-app/src-tauri/src/transfer_file.rs of the component File Transfer. The manipulation of the argument file_path with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs commands download_file and upload_file accepted a webview-controlled file_path and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. The commands were registered in the global invoke handler for the main, updater, and reader-* windows, so JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process. Exploitation requires JavaScript execution in that privileged origin, such as through an application XSS or compromised renderer; whether book-embedded JavaScript can reach the parent origin was not established. The write primitive can overwrite trusted or startup files, while the read primitive can expose keys, tokens, and application secrets. This issue is fixed in version 0.11.10.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-57567 since 06/24/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

Upgrading to version 0.11.10 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Readest

Version

• 0.11.0
• 0.11.1
• 0.11.2
• 0.11.3
• 0.11.4
• 0.11.5
• 0.11.6
• 0.11.7
• 0.11.8
• 0.11.9

Website

• Product: https://github.com/readest/readest/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion