CVE-2025-58351

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-58351", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-08-29T16:19:59.009Z", "datePublished": "2025-09-03T03:20:54.579Z", "dateUpdated": "2025-09-03T15:44:28.350Z"}, "containers": {"cna": {"title": "Outline's Local File Storage Feature can Cause CSP Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/outline/outline/security/advisories/GHSA-gcj7-c9jv-fhgf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/outline/outline/security/advisories/GHSA-gcj7-c9jv-fhgf"}, {"name": "https://github.com/outline/outline/commit/18bc93c9c207329244c6909606a2393e863892a3", "tags": ["x_refsource_MISC"], "url": "https://github.com/outline/outline/commit/18bc93c9c207329244c6909606a2393e863892a3"}, {"name": "https://github.com/outline/outline/releases/tag/v0.84.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/outline/outline/releases/tag/v0.84.0"}], "affected": [{"vendor": "outline", "product": "outline", "versions": [{"version": ">= 0.72.0, < 0.84.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-03T03:20:54.579Z"}, "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. In versions 0.72.0 through 0.83.0, Outline introduced a feature which facilitates local file system storage capabilities as an optional file storage strategy. This feature allowed a CSP bypass as well as a ContentType bypass that might facilitate further attacks. In the case of self-hosting and using Outline FILE_STORAGE=local on the same domain as the Outline application, a malicious payload can be uploaded as a file attachment and bypass those CSP restrictions, allowing script execution within the context of another user. This is fixed in version 0.84.0."}], "source": {"advisory": "GHSA-gcj7-c9jv-fhgf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-03T13:46:57.802702Z", "id": "CVE-2025-58351", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-03T15:44:28.350Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-58351", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-03T13:46:57.802702Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-03T13:47:01.116Z"}}], "cna": {"title": "Outline's Local File Storage Feature can Cause CSP Bypass", "source": {"advisory": "GHSA-gcj7-c9jv-fhgf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "outline", "product": "outline", "versions": [{"status": "affected", "version": ">= 0.72.0, < 0.84.0"}]}], "references": [{"url": "https://github.com/outline/outline/security/advisories/GHSA-gcj7-c9jv-fhgf", "name": "https://github.com/outline/outline/security/advisories/GHSA-gcj7-c9jv-fhgf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/outline/outline/commit/18bc93c9c207329244c6909606a2393e863892a3", "name": "https://github.com/outline/outline/commit/18bc93c9c207329244c6909606a2393e863892a3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/outline/outline/releases/tag/v0.84.0", "name": "https://github.com/outline/outline/releases/tag/v0.84.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. In versions 0.72.0 through 0.83.0, Outline introduced a feature which facilitates local file system storage capabilities as an optional file storage strategy. This feature allowed a CSP bypass as well as a ContentType bypass that might facilitate further attacks. In the case of self-hosting and using Outline FILE_STORAGE=local on the same domain as the Outline application, a malicious payload can be uploaded as a file attachment and bypass those CSP restrictions, allowing script execution within the context of another user. This is fixed in version 0.84.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-03T03:20:54.579Z"}}}, "cveMetadata": {"cveId": "CVE-2025-58351", "state": "PUBLISHED", "dateUpdated": "2025-09-03T15:44:28.350Z", "dateReserved": "2025-08-29T16:19:59.009Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-09-03T03:20:54.579Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "outline", "vendor": "outline", "versions": [{"status": "affected", "version": ">= 0.72.0, < 0.84.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:getoutline:outline:*:*:*:*:*:*:*:*", "matchCriteriaId": "1060B3A4-4716-4849-B852-ED0BC56727C6", "versionEndExcluding": "0.84.0", "versionStartIncluding": "0.72.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. In versions 0.72.0 through 0.83.0, Outline introduced a feature which facilitates local file system storage capabilities as an optional file storage strategy. This feature allowed a CSP bypass as well as a ContentType bypass that might facilitate further attacks. In the case of self-hosting and using Outline FILE_STORAGE=local on the same domain as the Outline application, a malicious payload can be uploaded as a file attachment and bypass those CSP restrictions, allowing script execution within the context of another user. This is fixed in version 0.84.0."}, {"lang": "es", "value": "Outline es un servicio que permite la documentaci\u00f3n colaborativa. En las versiones 0.72.0 a la 0.83.0, Outline introdujo una caracter\u00edstica que facilita las capacidades de almacenamiento en el sistema de archivos local como una estrategia opcional de almacenamiento de archivos. Esta caracter\u00edstica permiti\u00f3 una omisi\u00f3n de CSP, as\u00ed como una omisi\u00f3n de ContentType que podr\u00eda facilitar ataques adicionales. En el caso de autoalojamiento y de usar Outline FILE_STORAGE=local en el mismo dominio que la aplicaci\u00f3n Outline, se puede cargar una carga \u00fatil maliciosa como un archivo adjunto y omitir esas restricciones de CSP, permitiendo la ejecuci\u00f3n de scripts dentro del contexto de otro usuario. Esto se ha corregido en la versi\u00f3n 0.84.0."}], "id": "CVE-2025-58351", "lastModified": "2026-10-19T17:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58351", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-03T13:46:57.802702Z", "version": "2.0.3"}}]}, "published": "2025-09-03T04:16:05.803", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/outline/outline/commit/18bc93c9c207329244c6909606a2393e863892a3"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/outline/outline/releases/tag/v0.84.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/outline/outline/security/advisories/GHSA-gcj7-c9jv-fhgf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-09-03T20:27:08.557308+00:00", "updated": "2025-09-03T20:27:08.557366+00:00", "vendors": ["getoutline", "getoutline$PRODUCT$outline"]}