readest vulnerabilities
CVEs whose affected-version data names the readest package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-57562Medium· 6.5PoCReadest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a cli…
CVE-2026-57565Medium· 6.5PoCReadest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from t…
CVE-2026-57566Critical· 9.3PoCReadest: Unauthenticated SSRF / open request proxy in /api/opds/proxy
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.…
CVE-2026-57567High· 8.6PoCReadest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs comman…