CVE-2026-57565: Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from the authenticated user's identifier and a client-controlled fileName without rejecting path separators or parent-directory traversal. In the R2 backend, apps/readest-app/src/utils/r2.ts placed that key into a new Request URL before signing it, and URL normalization collapsed parent-directory components so the resulting presigned PUT could escape the caller's namespace. An authenticated attacker who knew a target user identifier and book hash could overwrite or poison that user's stored book object and corrupt the associated filekey metadata; the exact cross-tenant escape was verified for the R2 backend. This issue is fixed in version 0.11.10.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Readestto a version that resolves this vulnerability.Fixed in 0.11.10
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and must know both the target user's identifier and the target book hash. The verified cross-tenant escape applies to the R2 storage backend.
What can a successful attacker do?
They can obtain a presigned PUT that writes outside their own storage namespace, allowing them to overwrite or poison another user's stored book object. This can also corrupt the associated file_key metadata.
Which versions need remediation?
Readest versions prior to 0.11.10 are affected. Upgrade to version 0.11.10 or later.