PT-2026-7663 · Outline · Outline

Odgrso · Published 2026-02-11 · Updated 2026-02-20 · CVE-2026-25062

Positive Technologies · (AI Summary)

CVSS v3.1

5.5

Medium

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Outline versions prior to 1.4.0

Description Outline is a collaborative documentation service. Before version 1.4.0, the application was susceptible to a file-reading issue during the JSON import process. Specifically, the attachments[].key value from imported JSON was used directly in constructing a file path using path.join(rootPath, node.key) and subsequently read using fs.readFile without proper validation. This allowed an attacker to potentially read arbitrary files on the server by embedding path traversal sequences like ../ or absolute paths within the attachments[].key value, effectively importing these files as attachments.

Recommendations Update to version 1.4.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-25062

GHSA-7R4F-3WJV-83XF

Affected Products

Outline

References · 7

• 🔥 https://github.com/outline/outline/security/advisories/GHSA-7r4f-3wjv-83xf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25062.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-25062 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25062 · Security Note
• https://github.com/outline/outline/releases/tag/v1.4.0 · Note
• https://twitter.com/CVEnew/status/2021690045640368547 · Twitter Post
• https://t.me/cveNotify/152626 · Telegram Post