CVE-2026-57565

Name of the Vulnerable Software and Affected Versions Readest versions prior to 0.11.10

Description An issue exists where the application constructs an object key using the authenticated user identifier and a client-controlled fileName without properly rejecting path separators or parent-directory traversal. In the R2 backend, this key is placed into a Request URL before signing; URL normalization then collapses parent-directory components, allowing a presigned PUT request to escape the caller's namespace. An authenticated attacker with knowledge of a target user identifier and book hash can overwrite or poison another user's stored book object and corrupt the associated file key metadata.

Recommendations Update to version 0.11.10.