GHSA-mfmj-2frf-vhgw: Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from the authenticated user's identifier and a client-controlled fileName without rejecting path separators or parent-directory traversal. In the R2 backend, apps/readest-app/src/utils/r2.ts placed that key into a new Request URL before signing it, and URL normalization collapsed parent-directory components so the resulting presigned PUT could escape the caller's namespace. An authenticated attacker who knew a target user identifier and book hash could overwrite or poison that user's stored book object and corrupt the associated filekey metadata; the exact cross-tenant escape was verified for the R2 backend. This issue is fixed in version 0.11.10.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Readestto a version that resolves this vulnerability.Fixed in 0.11.10
Event History
Frequently Asked Questions
Which storage backend has confirmed cross-tenant impact?
The cross-tenant namespace escape was verified for the R2 backend. The advisory does not establish the same impact for other storage backends.
What does an attacker need to exploit this issue?
An attacker must be authenticated and must know the target user's identifier and book hash. They can use a client-controlled fileName containing path traversal components to obtain a presigned PUT targeting another tenant's object.
What is the likely impact if exploitation succeeds?
An attacker can overwrite or poison another user's stored book object and corrupt the related file_key metadata. The reported impact is integrity loss; no confidentiality or availability impact is stated.
What version remediates the issue?
Upgrade Readest to version 0.11.10 or later. Versions prior to 0.11.10 are affected.