CVE-2025-58351
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Outline versions 0.72.0 through 0.83.0 introduced local file system storage as an optional file storage strategy. This feature allowed a CSP bypass and a ContentType bypass that might facilitate further attacks. In self-hosting with FILE_STORAGE=local on the same domain as the Outline application, a malicious payload can be uploaded as a file attachment and bypass CSP restrictions, allowing script execution within another user's context. Fixed in version 0.84.0.
Risk Assessment
An attacker can upload a malicious file and execute script in another user's context, leading to session or data theft. Risk mainly affects self-hosted installations with local file storage.
Recommendation
Update Outline to version 0.84.0 or later. Consider using external file storage instead of FILE_STORAGE=local.
Other vulnerabilities in Outline
See all- CVE-2026-120489Medium
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retain parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.
- CVE-2026-120449Medium
Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can read withdrawn content, while shares.revoke returns 404 and blocks revocation.
- CVE-2026-43887High
Outline is a service that allows for collaborative documentation. From versions 0.84.0 to 1.6.1, the comment section permits users to mention other users; however, the backend does not validate or sanitize the href attribute associated with these mentions, potentially leading to client-side code execution.
- CVE-2026-43886High
Outline is a service that allows for collaborative documentation. From versions 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() allows the entire scope array to be accepted if any single scope is valid.
- CVE-2026-113611Medium
Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.
- CVE-2026-41649High
Outline versions 0.86.0 through 1.7.0 contain an insecure direct object reference (IDOR) vulnerability in the `shares.create` API endpoint. When both `collectionId` and `documentId` are provided in the request, the authorization logic only checks access to the collection, ignoring the document. This allows an authenticated attacker to generate a valid public share link for any document on the platform, including documents from other workspaces.
Original NVD description (English source)
Outline is a service that allows for collaborative documentation. In versions 0.72.0 through 0.83.0, Outline introduced a feature which facilitates local file system storage capabilities as an optional file storage strategy. This feature allowed a CSP bypass as well as a ContentType bypass that might facilitate further attacks. In the case of self-hosting and using Outline FILE_STORAGE=local on the same domain as the Outline application, a malicious payload can be uploaded as a file attachment and bypass those CSP restrictions, allowing script execution within the context of another user. This is fixed in version 0.84.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS