{"id":"CVE-2026-57567","kind":"vulnerability","aliases":["CVE-2026-57567"],"related":[],"title":"Readest desktop app: webview can read or overwrite any file","description":"Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs commands download_file and upload_file accepted a webview-controlled file_path and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. The commands were registered in the global invoke handler for the main, updater, and reader-* windows, so JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process. Exploitation requires JavaScript execution in that privileged origin, such as through an application XSS or compromised renderer; whether book-embedded JavaScript can reach the parent origin was not established. The write primitive can overwrite trusted or startup files, while the read primitive can expose keys, tokens, and application secrets. This issue is fixed in version 0.11.10.","summary":"Readest's desktop Tauri builds let the app's web interface call file download and upload commands that accept any file path without checking it. JavaScript running in the privileged app window could overwrite startup files or read keys and tokens from the machine.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","ebook-reader","package","readest","tauri"],"not_affected_if":["version-0.11.10-or-later","web-or-mobile-only"],"how_to_check":"- Check the installed Readest desktop version and compare it with `0.11.10`\n- Look for Readest desktop builds (Tauri) on Windows, macOS or Linux that are older than `0.11.10`","fix":"- Readest desktop (Tauri builds): move to `0.11.10` or later","status":"open","published_at":"2026-11-04T22:18:07+00:00","first_seen_at":"2026-11-04T23:08:49+00:00","triaged_at":"2026-11-04T23:09:47+00:00","updated_at":"2026-11-04T23:09:47+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T23:09:47Z","model":"claude-haiku-5-5","output":{"fix":"- Readest desktop (Tauri builds): move to `0.11.10` or later","reach":"local","title":"Readest desktop app: webview can read or overwrite any file","impact":"high","summary":"Readest's desktop Tauri builds let the app's web interface call file download and upload commands that accept any file path without checking it. JavaScript running in the privileged app window could overwrite startup files or read keys and tokens from the machine.","audience":"everyone","category":"package","nicknames":[],"who_cares":["readest","desktop","tauri","ebook-reader"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker writes or reads arbitrary files on the user's machine","analyst_note":"","how_to_check":"- Check the installed Readest desktop version and compare it with `0.11.10`\n- Look for Readest desktop builds (Tauri) on Windows, macOS or Linux that are older than `0.11.10`","plain_action":"Update the Readest ebook reader app on your desktop to version 0.11.10 or later.","needs_analyst":false,"not_affected_if":["web-or-mobile-only","version-0.11.10-or-later"],"who_is_affected":"Only desktop Tauri builds of Readest before 0.11.10 are affected, not the web or mobile versions. Exploitation needs JavaScript running in the app's privileged window, such as through an application XSS or a compromised renderer; the sources did not establish whether a book's embedded JavaScript can reach it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000731,"input_tokens":4535,"output_tokens":555,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-57567':13A,16A '0.11.10':96C,239C 'absolut':128C 'accept':42B,105C 'access':83C 'affect':90C 'app':3A,31B,54B 'applic':158C,195C,231C 'apps/readest-app/src-tauri/src/transfer_file.rs':98C 'attack':163C 'attacker-control':162C 'block':131C 'book':202C 'book-embed':201C 'build':28B,93C 'call':35B 'check':47B,122C 'command':40B,99C,137C 'compromis':198C 'content':165C 'control':109C,164C 'could':56B,160C 'creat':117C 'cross':81C 'cross-platform':80C 'cve':11A,14A 'design':77C 'desktop':2A,17B,26B,91C 'directori':134C 'download':37B,100C 'ebook':19B,75C 'ebook-read':18B 'embed':203C 'establish':212C 'execut':154C,186C 'experi':88C 'exploit':183C 'expos':227C 'featur':73C 'feature-rich':72C 'file':10A,36B,44B,59B,101C,104C,110C,116C,119C,221C 'filesystem':125C 'fix':236C 'global':142C 'handler':144C 'interfac':34B 'intuit':86C 'invok':143C 'issu':234C 'javascript':49B,153C,185C,204C 'key':62B,228C 'let':29B 'machin':67B 'main':147C 'modern':71C 'open':120C 'origin':159C,190C,209C 'overwrit':8A,57B,217C 'packag':21B 'parent':133C,208C 'parent-directori':132C 'pass':113C 'path':45B,111C,129C,168C,178C 'platform':82C 'primit':215C,225C 'prior':94C 'privileg':53B,157C,189C 'process':172C,182C 'reach':206C 'read':6A,61B,87C,174C,224C 'readabl':179C 'reader':20B,76C,150C 'readest':1A,22B,24B,68C 'regist':139C 'reject':127C 'render':199C 'requir':184C 'rich':74C 'run':50B 'scope':126C 'seamless':79C 'secret':232C 'send':176C 'startup':58B,220C 'tauri':23B,27B,92C,124C 'token':64B,229C 'travers':135C 'trust':218C 'updat':148C 'upload':39B,103C 'version':238C 'web':33B 'webview':4A,108C 'webview-control':107C 'whether':200C 'window':55B,151C 'without':46B,121C 'writabl':169C 'write':161C,214C 'xss':196C","nicknames":[],"mitigations":[],"who_affected":"Only desktop Tauri builds of Readest before 0.11.10 are affected, not the web or mobile versions. Exploitation needs JavaScript running in the app's privileged window, such as through an application XSS or a compromised renderer; the sources did not establish whether a book's embedded JavaScript can reach it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update the Readest ebook reader app on your desktop to version 0.11.10 or later.","pkeys":[],"ptokens":[],"labels":["desktop","ebookreader","high","package","readest","tauri"],"campaign_type":null,"first_public_at":"2026-10-15T04:56:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57567","severity":null,"published_at":"2026-11-04T22:18:07+00:00","modified_at":"2026-11-04T22:18:07+00:00","first_seen_at":"2026-11-04T23:08:49+00:00","fetched_at":"2026-11-04T23:08:49+00:00","note":null}],"documents":[{"id":71175,"url":"https://github.com/readest/readest/commit/4025c4d7b52c8c174ec1d4c02c2a864cce249604","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71176,"url":"https://github.com/readest/readest/commit/446c2c72de198de2dfcd63589f549ca517961d15","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71166,"url":"https://github.com/readest/readest/releases/tag/v0.11.10","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71178,"url":"https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-15T04:56:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}