Readest up to 0.11.9 Upload upload.ts path traversal

Summaryinfo

A vulnerability identified as problematic has been detected in Readest up to 0.11.9. Affected is an unknown function of the file apps/readest-app/src/pages/api/storage/upload.ts of the component Upload. Performing a manipulation results in path traversal. This vulnerability is known as CVE-2026-57565. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Readest up to 0.11.9. This affects some unknown functionality of the file apps/readest-app/src/pages/api/storage/upload.ts of the component Upload. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on integrity. The summary by CVE is:

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from the authenticated user's identifier and a client-controlled fileName without rejecting path separators or parent-directory traversal. In the R2 backend, apps/readest-app/src/utils/r2.ts placed that key into a new Request URL before signing it, and URL normalization collapsed parent-directory components so the resulting presigned PUT could escape the caller's namespace. An authenticated attacker who knew a target user identifier and book hash could overwrite or poison that user's stored book object and corrupt the associated file_key metadata; the exact cross-tenant escape was verified for the R2 backend. This issue is fixed in version 0.11.10.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-57565 since 06/24/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading to version 0.11.10 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Readest

Version

• 0.11.0
• 0.11.1
• 0.11.2
• 0.11.3
• 0.11.4
• 0.11.5
• 0.11.6
• 0.11.7
• 0.11.8
• 0.11.9

Website

• Product: https://github.com/readest/readest/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion