# CVE-2026-43888: Outline path traversal via path length truncation in ZipHelper

Source: https://junglewise.ai/threats/cve-2026-43888-outline-path-traversal-via-path-length-truncation-in-ziphelper  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-43888 · Severity: high · CVSS 8.7 · Published 2026-05-11

Outline is a collaborative documentation platform. A vulnerability in how the service handles ZIP file imports allows an administrative user to write files outside of the intended temporary folder and into the server's working directory. This could allow an attacker to overwrite critical configuration files or application source code, potentially leading to a complete service outage or unauthorized system modifications.

Technologies: [Jigsaw Outline](https://junglewise.ai/threats/technologies/outline). Vendors: [Jigsaw](https://junglewise.ai/threats/vendors/jigsaw).

## Quick answers

**Is CVE-2026-43888 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43888 being exploited in the wild.

**How severe is CVE-2026-43888?** High severity, with a CVSS score of 8.7, published 11 May 2026.

**Which products and versions are affected?** Jigsaw Outline < 1.7.0.

**Is there a fix for CVE-2026-43888?** A patch was published on 2026-05-11: Fix released in version 1.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43888 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-43888?** Check whether you run Jigsaw Outline at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in `ZipHelper.extract` due to improper handling of long file paths during ZIP extraction. When a nested path within a ZIP archive exceeds the `MAX_PATH_LENGTH` (4096 bytes), the `trimFileAndExt` helper function truncates the path by calling `path.basename`, which strips all directory components and returns only the filename. Consequently, `fs.createWriteStream` saves the file relative to the process's current working directory (CWD) instead of the intended temporary extraction sandbox. An attacker with 'Team Admin' privileges can exploit this via the `collections.import` API to overwrite sensitive files like `.env` or application source code. The vulnerability is fixed in version 1.7.0.

## Affected products

- Outline Outline < 1.7.0

## Timeline

- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Fix released in version 1.7.0

## References

- [https://github.com/outline/outline/security/advisories/GHSA-hw32-2v7j-mgqc](https://github.com/outline/outline/security/advisories/GHSA-hw32-2v7j-mgqc)

## Related threats

- [Outline account linking bypass in Slack integration callback](https://junglewise.ai/threats/cve-2026-44695-outline-account-linking-bypass-in-slack-integration-callback)
- [Outline incorrect authorization in shares.create API](https://junglewise.ai/threats/cve-2026-43889-outline-incorrect-authorization-in-shares-create-api)
- [Outline IDOR in shares.create API allows cross-workspace document access](https://junglewise.ai/threats/cve-2026-41649-outline-idor-in-shares-create-api-allows-cross-workspace-document)