CVE-2026-43888
Received Received - Intake
Zip Slip Vulnerability in Outline Document Collaboration Service

Publication date: 2026-05-11

Last updated on: 2026-05-11

Assigner: GitHub, Inc.

Description
Outline is a service that allows for collaborative documentation. Prior to 1.7.0, ZipHelper.extract computes the extraction path for each entry by passing a full filesystem path through trimFileAndExt, a filename helper that calls path.basename on its input when truncating. When a zip entry's nested path is long enough to push the joined filesystem path over MAX_PATH_LENGTH (4096 bytes), trimFileAndExt silently drops all directory components and returns a bare filename. fs.createWriteStream then opens the file relative to the process working directory instead of inside the extraction sandbox, and the escaped file persists after import cleanup because cleanupExtractedData only removes the temporary extraction directory. This vulnerability is fixed in 1.7.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-11
Last Modified
2026-05-11
Generated
2026-05-12
AI Q&A
2026-05-12
EPSS Evaluated
N/A
NVD
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Outline service prior to version 1.7.0, specifically in the ZipHelper.extract function. When extracting files from a zip archive, if a nested path inside the zip is long enough to exceed the maximum allowed path length (4096 bytes), the filename helper trimFileAndExt drops all directory components and returns only a bare filename. As a result, the file is extracted outside the intended extraction sandbox, into the process's working directory. This escaped file remains after the import cleanup because the cleanup process only removes the temporary extraction directory.


How can this vulnerability impact me? :

This vulnerability can lead to files being extracted outside the intended safe directory, potentially overwriting or creating files in arbitrary locations on the filesystem. Because the escaped files persist after cleanup, this can be exploited to place malicious files or manipulate existing files, leading to high impact on integrity and availability of the system.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, upgrade the Outline service to version 1.7.0 or later, where the issue has been fixed.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart