Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-57567— Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview

Quick assessment

Affected
readest readest
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Readest 是一款功能丰富的现代电子书阅读器，旨在提供无缝的跨平台访问和直观的阅读体验。在受影响版本（0.11.10 之前）的桌面端 Tauri 构建中， 文件中的 和 命令会接受由 Web 视图（webview）控制的 参数，并直接将其传递给 或 ，而并未检查 Tauri 文件系统作用域（filesystem scope），也未拒绝绝对路径或阻止父目录遍历攻击。 这些命令已注册到主窗口（main）、更新器窗口（updater）以及 系列窗口的全局 invoke 处理器中。因此，在特权应用源（privilege

CVSS 8.6 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57567

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview
Source: CVE Program / CVE List V5
Vulnerability Description
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs commands download_file and upload_file accepted a webview-controlled file_path and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. The commands were registered in the global invoke handler for the main, updater, and reader-* windows, so JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process. Exploitation requires JavaScript execution in that privileged origin, such as through an application XSS or compromised renderer; whether book-embedded JavaScript can reach the parent origin was not established. The write primitive can overwrite trusted or startup files, while the read primitive can expose keys, tokens, and application secrets. This issue is fixed in version 0.11.10.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
readest readest < 0.11.10 -

II. Public POCs for CVE-2026-57567

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57567

请登录查看更多情报信息。

Other References for CVE-2026-57567 (6)

Same Patch Batch · readest · 2026-11-04 · 4 CVEs total

CVE-2026-57566 9.3 CRITICAL Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy
CVE-2026-57565 6.5 MEDIUM Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object
CVE-2026-57562 6.5 MEDIUM Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Sessio

IV. Related Vulnerabilities

Same product: readest
Same vendor: readest
Same weakness: CWE-22