CVE-2026-57565

The Readest ebook reader (versions prior to 0.11.10 ) is vulnerable to a path traversal flaw in the apps/readest-app/src/pages/api/storage/upload.ts route. The application constructs an object key using a client-controlled fileName without rejecting path separators. Because the R2 backend (apps/r...