Readest ebook reader flaws allow file read/write and server proxy abuse

Summary

Desktop builds of the Readest ebook reader let scripts write or read arbitrary files, and self-hosted servers act as an open request proxy for anyone without login. Builds before 0.11.10 are affected.

Affected when

• Desktop app before 0.11.10
• JavaScript running in the app window (file features)
• Self-hosted Node or Docker server (internal network attacks)

What to do

Update to 0.11.10 or later.

Products and platforms

• Windows
• macOS
• Linux
• readest

CVE IDs

• CVE-2026-57567 (opens in a new tab)
• CVE-2026-57566 (opens in a new tab)
• CVE-2026-57565 (opens in a new tab)
• CVE-2026-57562 (opens in a new tab)

Sources

• Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)

Times

First published 2026-11-04 21:43 UTC

First seen 2026-11-09 16:20 UTC