CVE-2026-57565— Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)

Quick assessment

Affected

readest readest

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Readest 是一款现代化的、功能丰富的电子书阅读器，旨在提供无缝的跨平台访问和直观的阅读体验。在 0.11.10 版本之前，路由在构建对象键时，使用了经过身份验证的用户标识符和由客户端控制的，但未拒绝路径分隔符或父目录遍历字符。在 R2 后端中，将该键放入新的请求 URL 中再进行签名，而 URL 规范化过程会折叠父目录组件，导致生成的预签名 PUT 请求能够逃逸出调用者的命名空间。若攻击者已获知目标用户的标识符和书籍哈希值，即可覆盖或污染该用户存储的书籍对象，并破坏关联的元数据；此跨租户逃逸问题已在

CVSS 6.5 · Medium Updated Nov 05, 2026

Possible ATT&CK Techniques 3 AI

T1070.001 T1055 · Process Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)

Source: CVE Program / CVE List V5

Vulnerability Description

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from the authenticated user's identifier and a client-controlled fileName without rejecting path separators or parent-directory traversal. In the R2 backend, apps/readest-app/src/utils/r2.ts placed that key into a new Request URL before signing it, and URL normalization collapsed parent-directory components so the resulting presigned PUT could escape the caller's namespace. An authenticated attacker who knew a target user identifier and book hash could overwrite or poison that user's stored book object and corrupt the associated file_key metadata; the exact cross-tenant escape was verified for the R2 backend. This issue is fixed in version 0.11.10.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
readest	readest	< 0.11.10	-

II. Public POCs for CVE-2026-57565

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-57565

请登录查看更多情报信息。

Other References for CVE-2026-57565 (4)

https://github.com/readest/readest/pull/4638 x_refsource_MISC
https://github.com/readest/readest/releases/tag/v0.11.10 x_refsource_MISC
https://github.com/readest/readest/security/advisories/GHSA-mfmj-2frf-vhgw x_refsource_CONFIRM
https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-57565

Same Patch Batch · readest · 2026-11-04 · 4 CVEs total

CVE-2026-57566	9.3 CRITICAL	Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy
CVE-2026-57567	8.6 HIGH	Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and
CVE-2026-57562	6.5 MEDIUM	Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Sessio

IV. Related Vulnerabilities

Same product: readest

Same vendor: readest

Same weakness: CWE-22