CVE-2026-43888: high-severity vulnerability in outline
Outline: Zip Extraction Path Escape via PATH_MAX Truncation in Collection Import
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.4%
Outline is a service that allows for collaborative documentation. Prior to 1.7.0, ZipHelper.extract computes the extraction path for each entry by passing a full filesystem path through trimFileAndExt, a filename helper that calls path.basename on its input when truncating. When a zip entry's nested path is long enough to push the joined filesystem path over MAX_PATH_LENGTH (4096 bytes), trimFileAndExt silently drops all directory components and returns a bare filename. fs.createWriteStream then opens the file relative to the process working directory instead of inside the extraction sandbox, and the escaped file persists after import cleanup because cleanupExtractedData only removes the temporary extraction directory. This vulnerability is fixed in 1.7.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Affected products
outline · outlineRelated CVEs — outline
In the same product, most dangerous first.
CVE-2026-113611MEDIUMOutline before 1.8.0 Information Disclosure via Orphaned Webhook SubscriptionsEPSS 0.5%CVE-2024-40626HIGHStored Cross-site Scripting (XSS) vulnerability in Outline editorEPSS 0.5%CVE-2026-54573MEDIUMAuthorization Bypass in API Key/OAuth Scopes via Path Parsing DiscrepancyEPSS 0.5%CVE-2026-33640CRITICALOutline has a rate limit bypass that allows brute force of email login OTPEPSS 0.5%CVE-2026-25062MEDIUMOutline Affected an Arbitrary File Read via Path Traversal in JSON ImportEPSS 0.4%CVE-2025-58351MEDIUMOutline's Local File Storage Feature can Cause CSP BypassEPSS 0.4%