CVE-2026-43888 Details
Description
Outline is a service that allows for collaborative documentation. Prior to 1.7.0, ZipHelper.extract computes the extraction path for each entry by passing a full filesystem path through trimFileAndExt, a filename helper that calls path.basename on its input when truncating. When a zip entry's nested path is long enough to push the joined filesystem path over MAX_PATH_LENGTH (4096 bytes), trimFileAndExt silently drops all directory components and returns a bare filename. fs.createWriteStream then opens the file relative to the process working directory instead of inside the extraction sandbox, and the escaped file persists after import cleanup because cleanupExtractedData only removes the temporary extraction directory. This vulnerability is fixed in 1.7.0.
A path traversal vulnerability has been identified in Outline versions prior to 1.7.0, specifically within the ZipHelper.extract function. The issue arises when the extraction path for zip entries exceeds the maximum path length of 4096 bytes. In such cases, the filename helper function trimFileAndExt truncates the path, removing all directory components and leaving only the filename. This truncated filename is then used to create a write stream relative to the process's working directory, instead of within the designated extraction sandbox. As a result, the extracted file persists after the import process, since the cleanup function only removes temporary files, leaving the escaped file in the working directory.
Users are advised to update to Outline version 1.7.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 11, 2026CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/outline/outline/security/advisories/GHSA-hw32-2v7j-mgqc | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/outline/outline/security/advisories/GHSA-hw32-2v7j-mgqc | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Outline | < 1.7.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | [email protected] |