PT-2026-39856 · Outline · Outline

Bugbunny-Research · Published 2026-05-11 · Updated 2026-05-12 · CVE-2026-43888

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Outline versions prior to 1.7.0

Description An issue exists in the ZipHelper.extract function where the extraction path for each entry is computed by passing a full filesystem path through trimFileAndExt. This helper function uses path.basename when truncating. If a zip entry's nested path exceeds the MAX PATH LENGTH (4096 bytes), trimFileAndExt removes all directory components and returns only the filename. Consequently, fs.createWriteStream opens the file relative to the process working directory rather than within the intended extraction sandbox. Because cleanupExtractedData only removes the temporary extraction directory, the escaped file remains on the system after import cleanup.

Recommendations Update to version 1.7.0.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-43888

Affected Products

Outline

References · 4

• 🔥 https://github.com/outline/outline/security/advisories/GHSA-hw32-2v7j-mgqc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-43888 · Security Note
• https://t.me/CVEtracker/53419 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2054000109470277983 · Twitter Post