CVE-2026-57566

Name of the Vulnerable Software and Affected Versions Readest versions prior to 0.11.10

Description The unauthenticated '/api/opds/proxy' endpoint allows a remote attacker to perform Server-Side Request Forgery (SSRF), a technique where the server is tricked into making requests to an unintended location. The application fetches attacker-controlled URLs without restricting schemes or blocking private, loopback, link-local, or metadata hosts, and fails to revalidate destinations during automatic redirects. Additionally, the endpoint accepts caller-controlled outbound headers and Authorization values, reflecting the upstream status and response body. In Node, Docker, or self-hosted deployments with internal-network access, this can be used to retrieve cloud metadata or internal-service responses. While Cloudflare Workers deployments restrict access to link-local and private destinations, the public fetch-and-reflect behavior persists.

Recommendations Update to version 0.11.10.