Threats affecting pkg:github/readest/readest

Readest versions prior to 0.11.10 contain an authorization bypass vulnerability in the Stripe payment API endpoint. The application accepted a client-controlled sessionId without verifying ownership, allowing authenticated free users to replay valid paid session identifiers to upgrade additional accounts without payment. This flaw was fixed in version 0.11.10.

CVE-2026-57565 is a path traversal vulnerability in the Readest ebook reader prior to version 0.11.10. The flaw allows an authenticated attacker to craft a file name that includes path traversal sequences, enabling them to overwrite or poison another user's stored book object and corrupt associated metadata. This occurs due to improper validation of file names and URL normalization in the R2 backend. The issue is fixed in version 0.11.10.

CVE-2026-57566 is a critical server-side request forgery (SSRF) vulnerability in readest versions prior to 0.11.10. The unauthenticated /api/opds/proxy route allowed attackers to supply arbitrary URLs that the server would fetch without proper restrictions or validation. This enabled attackers to use the service as an open proxy to access internal network resources, including cloud metadata services on self-hosted deployments. Cloudflare Workers deployments mitigate internal network impact by restricting access to private and link-local addresses, but the fetch-and-reflect behavior remains unauthenticated. The issue is fixed in version 0.11.10.

CVE-2026-57567 is a path traversal vulnerability in the readest ebook reader affecting desktop Tauri builds prior to version 0.11.10. The flaw allows JavaScript running in the privileged application origin to read or write arbitrary files on the filesystem by exploiting insufficient validation of file paths in the download_file and upload_file commands. This can lead to exposure of sensitive data such as keys and tokens, or overwriting of trusted files. The issue is fixed in readest version 0.11.10.