CVE-2026-25062

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25062", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-28T14:50:47.889Z", "datePublished": "2026-02-11T20:23:07.052Z", "dateUpdated": "2026-02-11T20:53:58.855Z"}, "containers": {"cna": {"title": "Outline Affected an Arbitrary File Read via Path Traversal in JSON Import", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/outline/outline/security/advisories/GHSA-7r4f-3wjv-83xf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/outline/outline/security/advisories/GHSA-7r4f-3wjv-83xf"}, {"name": "https://github.com/outline/outline/releases/tag/v1.4.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/outline/outline/releases/tag/v1.4.0"}], "affected": [{"vendor": "outline", "product": "outline", "versions": [{"version": "< 1.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-11T20:23:07.052Z"}, "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. Prior to 1.4.0, during the JSON import process, the value of attachments[].key from the imported JSON is passed directly to path.join(rootPath, node.key) and then read using fs.readFile without validation. By embedding path traversal sequences such as ../ or absolute paths, an attacker can read arbitrary files on the server and import them as attachments. This vulnerability is fixed in 1.4.0."}], "source": {"advisory": "GHSA-7r4f-3wjv-83xf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T20:53:26.730901Z", "id": "CVE-2026-25062", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T20:53:58.855Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25062", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T20:53:26.730901Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T20:53:55.902Z"}}], "cna": {"title": "Outline Affected an Arbitrary File Read via Path Traversal in JSON Import", "source": {"advisory": "GHSA-7r4f-3wjv-83xf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "outline", "product": "outline", "versions": [{"status": "affected", "version": "< 1.4.0"}]}], "references": [{"url": "https://github.com/outline/outline/security/advisories/GHSA-7r4f-3wjv-83xf", "name": "https://github.com/outline/outline/security/advisories/GHSA-7r4f-3wjv-83xf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/outline/outline/releases/tag/v1.4.0", "name": "https://github.com/outline/outline/releases/tag/v1.4.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. Prior to 1.4.0, during the JSON import process, the value of attachments[].key from the imported JSON is passed directly to path.join(rootPath, node.key) and then read using fs.readFile without validation. By embedding path traversal sequences such as ../ or absolute paths, an attacker can read arbitrary files on the server and import them as attachments. This vulnerability is fixed in 1.4.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-11T20:23:07.052Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25062", "state": "PUBLISHED", "dateUpdated": "2026-02-11T20:53:58.855Z", "dateReserved": "2026-01-28T14:50:47.889Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-11T20:23:07.052Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "outline", "vendor": "outline", "versions": [{"status": "affected", "version": "< 1.4.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:getoutline:outline:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1297792-2032-4407-B790-09BFBDF42500", "versionEndExcluding": "1.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Outline is a service that allows for collaborative documentation. Prior to 1.4.0, during the JSON import process, the value of attachments[].key from the imported JSON is passed directly to path.join(rootPath, node.key) and then read using fs.readFile without validation. By embedding path traversal sequences such as ../ or absolute paths, an attacker can read arbitrary files on the server and import them as attachments. This vulnerability is fixed in 1.4.0."}, {"lang": "es", "value": "Outline es un servicio que permite la documentaci\u00f3n colaborativa. Antes de 1.4.0, durante el proceso de importaci\u00f3n de JSON, el valor de attachments[].key del JSON importado se pasa directamente a path.join(rootPath, node.key) y luego se lee usando fs.readFile sin validaci\u00f3n. Al incrustar secuencias de salto de ruta como ../ o rutas absolutas, un atacante puede leer archivos arbitrarios en el servidor e importarlos como adjuntos. Esta vulnerabilidad se corrigi\u00f3 en 1.4.0."}], "id": "CVE-2026-25062", "lastModified": "2026-06-17T10:24:04.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25062", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T20:53:26.730901Z", "version": "2.0.3"}}]}, "published": "2026-02-11T21:16:18.607", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/outline/outline/releases/tag/v1.4.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/outline/outline/security/advisories/GHSA-7r4f-3wjv-83xf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.0)"}}], "product": "outline", "vendor": "getoutline"}], "analysis": {"en": {"generated_at": "2026-04-17T20:14:33.645587+00:00", "value": {"mitigation_remediation": ["Upgrade Outline to version 1.4.0 or later.", "Restrict or temporarily disable access to the JSON import feature for non\u2011trusted users until the patch is applied.", "Test that the import endpoint rejects path\u2011traversal payloads by attempting to import a JSON containing '../' sequences and ensuring the request is denied."], "summary": {"action": "Patch", "impact": "Arbitrary File Read"}, "threat_synthesis": {"affected_systems": "Outline, the collaborative documentation platform, is affected whenever a version earlier than 1.4.0 is in use. The security advisory identifies version 1.4.0 as the release that fixes the issue.", "description_and_impact": "The vulnerability occurs when Outline's JSON import feature processes the attachments[].key value without sanitization. During import, the value is joined to the server's root path and read directly via fs.readFile. An attacker who can supply a crafted JSON payload containing path traversal sequences such as '../' or an absolute path can read any file located under the server's accessible file system. This results in a confidential data leak, with the risk that sensitive files, configuration data, or secrets may be exfiltrated. The weakness falls under the Common Weakness Enumeration CWE-22: Path Traversal.", "risk_and_exploitability": "The CVSS base score is 5.5, indicating moderate severity, while the EPSS score is less than 1%, showing that current exploitation likelihood is low and the vulnerability is not included in CISA's KEV catalog. Exploitation requires the ability to submit a JSON import payload; therefore the attack surface is limited to users who have access to the import endpoint or to those who can influence that process. Administrators should determine whether the import function is exposed to external users before evaluating immediate risk."}}}}, "created": "2026-02-12T10:01:06.039727+00:00", "updated": "2026-04-17T20:15:27.008613+00:00", "vendors": ["getoutline", "getoutline$PRODUCT$outline"]}