CVE-2026-57566— Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy

Quick assessment

Affected

readest readest

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Readest 是一款功能丰富的现代电子书阅读器，旨在提供无缝的跨平台访问和直观的阅读体验。在 0.11.10 版本之前，其未经验证的路由（位于）会接受攻击者控制的 URL，并在服务器端发起请求，且未对请求协议（scheme）进行限制，也未阻止对私有地址、回环地址、链路本地地址或元数据主机的访问，同时在自动重定向过程中未对目标地址进行重新验证。此外，该路由还接受调用者控制的出站请求头及 Authorization 值，并直接向上游反射响应状态码和响应体。远程攻击者可利用该服务作为开放请求代理。在 Node.j

CVSS 9.3 · Critical Updated Nov 05, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy

Source: CVE Program / CVE List V5

Vulnerability Description

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during automatic redirect following. The route also accepted caller-controlled outbound headers and Authorization values and reflected the upstream status and response body. A remote attacker could use the service as an open request proxy and, on Node, Docker, or other self-hosted deployments with internal-network access, retrieve cloud metadata or internal-service responses. Cloudflare Workers deployments restrict access to link-local and private destinations, which reduces the internal-network impact there, but the unauthenticated public fetch-and-reflect behavior remains. This issue is fixed in version 0.11.10.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
readest	readest	< 0.11.10	-

II. Public POCs for CVE-2026-57566

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-57566

请登录查看更多情报信息。

Other References for CVE-2026-57566 (4)

https://github.com/readest/readest/pull/4638 x_refsource_MISC
https://github.com/readest/readest/releases/tag/v0.11.10 x_refsource_MISC
https://github.com/readest/readest/security/advisories/GHSA-c7mm-g2j2-98cx x_refsource_CONFIRM
https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-57566

Same Patch Batch · readest · 2026-11-04 · 4 CVEs total

CVE-2026-57567	8.6 HIGH	Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and
CVE-2026-57565	6.5 MEDIUM	Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object
CVE-2026-57562	6.5 MEDIUM	Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Sessio

IV. Related Vulnerabilities

Same product: readest

Same vendor: readest

Same weakness: CWE-918