CVE-2026-57567
HighCVSS 8.6Summary
In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs commands download_file and upload_file accepted a webview-controlled file_path and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process.
Risk Assessment
If JavaScript executes in the privileged origin (e.g., via XSS or a compromised renderer), an attacker can overwrite trusted startup files or exfiltrate keys, tokens, and application secrets.
Recommendation
Upgrade Readest to version 0.11.10 or later; until then, avoid opening untrusted books and content in the application.
Other vulnerabilities in Readest
See all- CVE-2026-57566Critical
Readest prior to 0.11.10 contains an unauthenticated /api/opds/proxy route that fetches an attacker-controlled URL server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during redirects. The route also accepts caller-controlled outbound headers and Authorization values and reflects the upstream status and response body.
- CVE-2026-82642High
Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the <script> tag. DOMPurify does not parse the contents of the srcdoc attribute on <iframe> elements, so an attacker can embed a complete HTML document containing a <script> tag inside srcdoc and have it execute. The script can access Tauri IPC commands, escalating to arbitrary code execution.
Original NVD description (English source)
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs commands download_file and upload_file accepted a webview-controlled file_path and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. The commands were registered in the global invoke handler for the main, updater, and reader-* windows, so JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process. Exploitation requires JavaScript execution in that privileged origin, such as through an application XSS or compromised renderer; whether book-embedded JavaScript can reach the parent origin was not established. The write primitive can overwrite trusted or startup files, while the read primitive can expose keys, tokens, and application secrets. This issue is fixed in version 0.11.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS