CVE-2026-25062: Outline Affected an Arbitrary File Read via Path Traversal in JSON Import
Outline is a service that allows for collaborative documentation. Prior to 1.4.0, during the JSON import process, the value of attachments[].key from the imported JSON is passed directly to path.join(rootPath, node.key) and then read using fs.readFile without validation. By embedding path traversal sequences such as ../ or absolute paths, an attacker can read arbitrary files on the server and import them as attachments. This vulnerability is fixed in 1.4.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25062?
CVE-2026-25062 has been classified as a medium severity vulnerability due to the potential for unauthorized file access.
How do I fix CVE-2026-25062?
To remediate CVE-2026-25062, upgrade Outline to version 1.4.0 or later.
What type of vulnerability is CVE-2026-25062?
CVE-2026-25062 is a path traversal vulnerability affecting the JSON import functionality in Outline.
What software versions are affected by CVE-2026-25062?
CVE-2026-25062 affects versions of Outline prior to 1.4.0.
Can CVE-2026-25062 lead to data exposure?
Yes, CVE-2026-25062 can lead to unauthorized access to files on the server, potentially exposing sensitive data.