Readest is a modern ebook reader that handles user uploads via its "/api/storage/upload" endpoint. Before version 0.11.10, the supplied fileName was concatenated with the authenticated user’s identifier to produce an object key for storage. The code did not reject path separators or parent‑directory traversal characters, allowing an attacker who knows another tenant’s user ID to craft a path that escapes their namespace. By signing a presigned PUT for that key, the attacker can overwrite or corrupt the target user’s book object and associated metadata. This flaw is a classic path traversal that allows arbitrary object overwrite across tenants, leading to data integrity loss and potential service disruption for victims.

The affected product is Readest (readest:readest). All deploys running any version prior to 0.11.10 are susceptible to this cross‑tenant write vulnerability. The issue was fixed in the 0.11.10 release.

The CVSS score for this vulnerability is 6.5. EPSS data is not available, and the weakness is not listed in CISA’s KEV catalog. Attack requires an authenticated session with knowledge of another tenant’s user ID and book hash. Because the path traversal occurs during construction of a presigned PUT URL, the attacker can execute the exploit over the network without additional privileges. Current data suggests the risk is moderate, but the lack of a published exploit and absence from KEV indicates it may not be widely targeted yet.