CVE-2026-25062: 
NixOS vulnerability analysis and mitigation

CVE-2026-25062 is a path traversal vulnerability in Outline, an open-source collaborative documentation service, that allows authenticated attackers with administrator privileges to read arbitrary files on the server during the JSON import process. All versions of Outline prior to 1.4.0 are affected. The vulnerability was published on February 11, 2026, and fixed in version 1.4.0. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is improper path validation (CWE-22) in server/queues/tasks/ImportJSONTask.ts (lines 103–117). During JSON import, the attachments[].key value from the imported JSON is passed directly to path.join(rootPath, node.key) and subsequently read via fs.readFile without any sanitization or boundary checks. Because Node.js's path.join does not prevent traversal when given ../ sequences or absolute paths, an attacker can craft a ZIP archive containing a malicious JSON payload with manipulated attachments[].key values to escape the extraction root directory and read arbitrary files accessible to the Outline process (GitHub Advisory). Exploitation requires administrator-level privileges and the ability to upload a crafted ZIP file via the JSON-based import feature.

Successful exploitation allows a privileged attacker to exfiltrate arbitrary files readable by the Outline server process, including .env files, application configuration files, private keys, and database connection credentials. The primary impact is high confidentiality loss, with a low integrity impact due to the ability to manipulate imported data; availability is not affected. While exploitation requires high privileges, the potential for sensitive credential disclosure could enable further lateral movement or full infrastructure compromise (GitHub Advisory).

A proof-of-concept reference is available via the GitHub security advisory, though there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.016%, reflecting low current exploitation probability. No threat actor attribution or CISA KEV catalog listing has been reported for this vulnerability (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target Outline instance running a version prior to 1.4.0 and obtain or compromise an administrator account with permission to perform importCollection.
2. Craft malicious JSON: Create a JSON document containing an attachments array where one or more entries have a key value set to a path traversal sequence (e.g., ../../../../../../etc/passwd or an absolute path like /etc/passwd) targeting sensitive server files.
3. Package as ZIP: Bundle the crafted JSON file into a ZIP archive in the format expected by Outline's JSON import feature.
4. Upload and trigger import: Use the Outline administrator interface or API to upload the crafted ZIP archive and initiate the JSON import process (importCollection).
5. Retrieve exfiltrated file: The server reads the targeted file via fs.readFile(path.join(rootPath, node.key)) without validation and imports its contents as an attachment, which the attacker can then access through the Outline interface to obtain sensitive data such as .env credentials or private keys (GitHub Advisory).

• Logs: Outline application logs showing JSON import operations (importCollection) initiated by administrator accounts, particularly with unusual timing or frequency; file system access errors or unexpected file reads logged by the Node.js process outside the expected upload/extraction directory.
• File System: Presence of crafted ZIP archives in upload or temporary directories containing JSON with attachments[].key values containing ../ sequences or absolute paths.
• Network: Outbound data transfers from the Outline server following import operations that are disproportionate in size to the imported content, potentially indicating exfiltration of sensitive files.
• Process Behavior: Node.js process (outline) accessing files outside its expected working directories (e.g., /etc/, application root parent directories) as observable via system call auditing tools such as auditd or strace (GitHub Advisory).

Upgrade Outline to version 1.4.0 or later, which resolves the vulnerability by adding proper validation of attachments[].key values during JSON import (Outline v1.4.0 Release). As a temporary workaround for deployments that cannot immediately upgrade, restrict JSON import functionality to the most trusted administrator accounts and monitor import operations for path traversal patterns (e.g., ../ or absolute paths) in attachment keys. Additionally, running the Outline service under a least-privilege OS account limits the scope of files accessible if exploitation occurs (GitHub Advisory).

The vulnerability was reported by security researcher odgrso and the advisory was published by Outline maintainer tommoor on February 11, 2026. A NixOS/nixpkgs issue was opened to track the package update to the patched version, indicating community awareness in the self-hosted Linux ecosystem (GitHub Advisory). No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified.