Outline CVE-2026-43888

Requires an authenticated Outline account with permission to use the document/collection ZIP import feature (vendor CVSS marks PR:H; in practice import may be available to standard members - confirm your permission model). The attacker must supply a crafted import archive containing an entry whose nested internal path is long enough that the full joined filesystem path exceeds MAX_PATH_LENGTH (4096 bytes), which is the exact trigger that makes trimFileAndExt drop directory components. Limiting factors: exploitation only affects Outline versions prior to 1.7.0, needs the import functionality to be enabled and reachable, and produces a write of a bare-filename file into the process working directory rather than arbitrary path traversal - the attacker does not control the target directory, only the filename, and gains no confidentiality/read access.

Signals are mixed and lean toward moderate, targeted risk rather than mass exploitation. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H, 8.7 High) indicates a remotely reachable, low-complexity issue that nonetheless requires elevated privileges (PR:H) and yields no confidentiality loss but high integrity/availability impact with a scope change - consistent with an authenticated actor corrupting files outside the sandbox. SSVC aligns: Exploitation=poc, Automatable=no, Technical Impact=total. EPSS is only 0.04% (12th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active or automated exploitation. The main tension is privilege level versus real-world feature exposure: the vendor rated PR:H, but document import in Outline is often available to ordinary members, which would lower the true barrier - verify the import-permission model in your deployment. Note also the vector marks C:N while integrity/availability are High, meaning the practical damage is unwanted/overwritten files in the working directory rather than data theft; the actual severity depends on what sensitive files live in the process CWD.

An authenticated user permitted to import documents crafts a ZIP whose single entry uses a deeply nested internal path long enough to push the joined extraction path past 4096 bytes, then uploads it through Outline's import feature. During extraction the directory components are silently stripped, and the attacker-controlled file is written by its bare name into the server's process working directory, where it persists after import cleanup - potentially overwriting a file the application relies on. Public POC-level detail exists per SSVC, lowering the effort to reproduce.