CVE-2026-57567: Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transferfile.rs commands downloadfile and uploadfile accepted a webview-controlled filepath and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. The commands were registered in the global invoke handler for the main, updater, and reader- windows, so JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process. Exploitation requires JavaScript execution in that privileged origin, such as through an application XSS or compromised renderer; whether book-embedded JavaScript can reach the parent origin was not established. The write primitive can overwrite trusted or startup files, while the read primitive can expose keys, tokens, and application secrets. This issue is fixed in version 0.11.10.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Readestto a version that resolves this vulnerability.Fixed in 0.11.10
Event History
Frequently Asked Questions
Who is exposed to this issue?
Affected desktop Tauri builds prior to 0.11.10 are exposed. The vulnerable commands are available to the main, updater, and reader-* windows through the global invoke handler.
What does an attacker need to exploit it?
An attacker needs JavaScript execution in Readest's privileged application origin, such as from an application XSS or a compromised renderer. It was not established whether JavaScript embedded in a book can reach that parent origin.
What access can successful exploitation provide?
The attacker can read files readable by the application process and send their contents out, including keys, tokens, and application secrets. They can also write attacker-controlled content to any filesystem path writable by the process, potentially overwriting trusted or startup files.
What should teams do to remediate this issue?
Update affected desktop Tauri builds to version 0.11.10, which fixes the issue.