# CVE-2026-57567: Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview

Status: published. Published: 2026-11-04. Updated: 2026-11-04.

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs commands download_file and upload_file accepted a webview-controlled file_path and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. The commands were registered in the global invoke handler for the main, updater, and reader-* windows, so JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process. Exploitation requires JavaScript execution in that privileged origin, such as through an application XSS or compromised renderer; whether book-embedded JavaScript can reach the parent origin was not established. The write primitive can overwrite trusted or startup files, while the read primitive can expose keys, tokens, and application secrets. This issue is fixed in version 0.11.10.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- readest / readest: < 0.11.10 (affected). Source: CNA: GitHub_M

## Severity and prioritization

- CVSS 3.1: 8.6 (high); CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-22

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/readest/readest/pull/4639 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/readest/readest/pull/4651 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/readest/readest/commit/4025c4d7b52c8c174ec1d4c02c2a864cce249604 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/readest/readest/commit/446c2c72de198de2dfcd63589f549ca517961d15 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/readest/readest/releases/tag/v0.11.10 (CNA: GitHub_M; x_refsource_MISC)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-57567; retrieved 2026-11-04; source updated 2026-11-04

Revision: df1c35385e8a3e4db1c75644d6543bb5918c585ca7914f5a00d9a10728ce882f

Canonical: https://y2.dev/cve/CVE-2026-57567

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.