Vulnerabilities in readest

5 results

CVE-2026-57565MEDIUMReadest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)EPSS 1.0%CVE-2026-82642HIGHReadest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code executionEPSS 0.7%CVE-2026-57567HIGHReadest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webviewEPSS 0.7%CVE-2026-57566CRITICALReadest: Unauthenticated SSRF / open request proxy in /api/opds/proxyEPSS 0.6%CVE-2026-57562MEDIUMReadest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the callerEPSS 0.4%