Executive brief
Outline is a collaborative documentation platform. A vulnerability in how the service handles ZIP file imports allows an administrative user to write files outside of the intended temporary folder and into the server's working directory. This could allow an attacker to overwrite critical configuration files or application source code, potentially leading to a complete service outage or unauthorized system modifications.
Technical details
A path traversal vulnerability exists in `ZipHelper.extract` due to improper handling of long file paths during ZIP extraction. When a nested path within a ZIP archive exceeds the `MAX_PATH_LENGTH` (4096 bytes), the `trimFileAndExt` helper function truncates the path by calling `path.basename`, which strips all directory components and returns only the filename. Consequently, `fs.createWriteStream` saves the file relative to the process's current working directory (CWD) instead of the intended temporary extraction sandbox. An attacker with 'Team Admin' privileges can exploit this via the `collections.import` API to overwrite sensitive files like `.env` or application source code. The vulnerability is fixed in version 1.7.0.
Affected products
- Outline Outline < 1.7.0
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Fix released in version 1.7.0