Path Traversal Vulnerability in Readest Ebook Reader
CVE-2026-57567

8.6HIGH

Key Information:

Vendor

Readest

Status
Readest
Vendor
CVE Published:
4 November 2026

What is CVE-2026-57567?

The Readest Ebook Reader, designed for a seamless cross-platform experience, includes a vulnerability in its Tauri desktop builds prior to version 0.11.10. Specifically, the 'download_file' and 'upload_file' commands allowed for webview-controlled file paths to be processed without adequate filesystem restrictions. This oversight permitted JavaScript executed in the app's privileged context to read or write files outside the intended directory. An attacker could exploit this gap to overwrite files or extract sensitive information, potentially compromising application secrets and tokens. The issue has been addressed in version 0.11.10.

Affected Version(s)

readest < 0.11.10

References

https://github.com/readest/readest/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/readest/readest/pull/4639
x_refsource_MISC
https://github.com/readest/readest/pull/4651
x_refsource_MISC

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.