CVE-2026-57565 · Other
NO FIX YET · SEE WHAT TO DO
Readest's storage upload route built file keys from a client-supplied file name without blocking path traversal, and the R2 backend normalized those paths. An authenticated attacker can therefore write to another user's stored book object and corrupt its metadata.
first public Oct 15, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Exposure requires an authenticated account and the R2 storage backend, since the cross-tenant escape was verified there. Operators of Readest instances that use R2 for user book storage are in scope. Instances using other storage backends or running 0.11.10 or later are not affected by this report.
Not affected if non-r2-storage, version-0.11.10-or-later
Who cares cloudflare-r2, readest, self-hosted
0.11.10.0.11.10 or later.Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from the authenticated user's identifier and a client-controlled fileName without rejecting path separators or parent-directory traversal. In the R2 backend, apps/readest-app/src/utils/r2.ts placed that key into a new Request URL before signing it, and URL normalization collapsed parent-directory components so the resulting presigned PUT could escape the caller's namespace. An authenticated attacker who knew a target user identifier and book hash could overwrite or poison that user's stored book object and corrupt the associated file_key metadata; the exact cross-tenant escape was verified for the R2 backend. This issue is fixed in version 0.11.10.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.