---
id: CVE-2026-57567
title: >-
  Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local
  file write and read from the webview
summary: >-
  Readest is a modern, feature-rich ebook reader designed for seamless
  cross-platform access and an intuitive reading experience. In affected desktop
  Tauri builds prior to 0.11.10, the
  apps/readest-app/src-tauri/src/transfer_file.rs comman…
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
vendor: readest
product: readest
affected:
  - readest < 0.11.10
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-05T20:03:07.789551Z'
exploitAvailable: true
published: '2026-11-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:04:00.199Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-57567'
references:
  - url: 'https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg'
    label: 'https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg'
  - url: 'https://github.com/readest/readest/pull/4639'
    label: 'https://github.com/readest/readest/pull/4639'
  - url: 'https://github.com/readest/readest/pull/4651'
    label: 'https://github.com/readest/readest/pull/4651'
  - url: >-
      https://github.com/readest/readest/commit/4025c4d7b52c8c174ec1d4c02c2a864cce249604
    label: >-
      https://github.com/readest/readest/commit/4025c4d7b52c8c174ec1d4c02c2a864cce249604
  - url: >-
      https://github.com/readest/readest/commit/446c2c72de198de2dfcd63589f549ca517961d15
    label: >-
      https://github.com/readest/readest/commit/446c2c72de198de2dfcd63589f549ca517961d15
  - url: 'https://github.com/readest/readest/releases/tag/v0.11.10'
    label: 'https://github.com/readest/readest/releases/tag/v0.11.10'
tags:
  - cve.org
  - exploit-available
epss: 0.00663
epssPercentile: 0.51964
ingestedAt: '2026-11-05T22:38:31.693Z'
---

## Overview

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs commands download_file and upload_file accepted a webview-controlled file_path and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. The commands were registered in the global invoke handler for the main, updater, and reader-* windows, so JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process. Exploitation requires JavaScript execution in that privileged origin, such as through an application XSS or compromised renderer; whether book-embedded JavaScript can reach the parent origin was not established. The write primitive can overwrite trusted or startup files, while the read primitive can expose keys, tokens, and application secrets. This issue is fixed in version 0.11.10.

## Affected

- `readest < 0.11.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.