---
id: "CVE-2026-57565"
kind: "vulnerability"
aliases: ["CVE-2026-57565"]
title: "Readest: authenticated users can overwrite other users' stored ebooks"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["cloudflare-r2", "other", "readest", "self-hosted"]
not_affected_if: ["non-r2-storage", "version-0.11.10-or-later"]
published_at: "2026-11-04T22:18:06+00:00"
first_seen_at: "2026-11-04T23:08:49+00:00"
updated_at: "2026-11-04T23:10:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57565", "first_seen_at": "2026-11-04T23:08:49+00:00"}]
exploit_sources: []
---

# Readest: authenticated users can overwrite other users' stored ebooks

Readest's storage upload route built file keys from a client-supplied file name without blocking path traversal, and the R2 backend normalized those paths. An authenticated attacker can therefore write to another user's stored book object and corrupt its metadata.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Readest version in use; affected builds are those before `0.11.10`.
- If you run Readest with the R2 storage backend, review apps/readest-app/src/pages/api/storage/upload.ts and apps/readest-app/src/utils/r2.ts for the file key construction.

## Fix

- Move to Readest `0.11.10` or later.

## Timeline

- 2026-11-04T23:08:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57565

## Documents

- [advisory] Vendor advisory: github.com https://github.com/readest/readest/security/advisories/GHSA-mfmj-2frf-vhgw
- [fix] Patch: github.com https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de
- [fix] Release notes: github.com https://github.com/readest/readest/releases/tag/v0.11.10

## From the sources

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from the authenticated user's identifier and a client-controlled fileName without rejecting path separators or parent-directory traversal. In the R2 backend, apps/readest-app/src/utils/r2.ts placed that key into a new Request URL before signing it, and URL normalization collapsed parent-directory components so the resulting presigned PUT could escape the caller's namespace. An authenticated attacker who knew a target user identifier and book hash could overwrite or poison that user's stored book object and corrupt the associated file_key metadata; the exact cross-tenant escape was verified for the R2 backend. This issue is fixed in version 0.11.10.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_