readest has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was November 2026 with 4. The median CVSS is 7.5 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-57566Critical· 9.3Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy63CVE-2026-57567High· 8.6Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview59CVE-2026-57565Medium· 6.5Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)48CVE-2026-57562Medium· 6.5Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller48
readest vulnerabilities
CVEs affecting readest, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-57562Medium· 6.5PoCReadest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a cli…
CVE-2026-57565Medium· 6.5PoCReadest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from t…
CVE-2026-57566Critical· 9.3PoCReadest: Unauthenticated SSRF / open request proxy in /api/opds/proxy
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.…
CVE-2026-57567High· 8.6PoCReadest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs comman…