CVE-2025-58351

{
  "id": "CVE-2025-58351",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-03T04:16:05.803",
  "lastModified": "2026-10-19T17:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Outline is a service that allows for collaborative documentation. In versions 0.72.0 through 0.83.0, Outline introduced a feature which facilitates local file system storage capabilities as an optional file storage strategy. This feature allowed a CSP bypass as well as a ContentType bypass that might facilitate further attacks. In the case of self-hosting and using Outline FILE_STORAGE=local on the same domain as the Outline application, a malicious payload can be uploaded as a file attachment and bypass those CSP restrictions, allowing script execution within the context of another user. This is fixed in version 0.84.0."
    },
    {
      "lang": "es",
      "value": "Outline es un servicio que permite la documentación colaborativa. En las versiones 0.72.0 a la 0.83.0, Outline introdujo una característica que facilita las capacidades de almacenamiento en el sistema de archivos local como una estrategia opcional de almacenamiento de archivos. Esta característica permitió una omisión de CSP, así como una omisión de ContentType que podría facilitar ataques adicionales. En el caso de autoalojamiento y de usar Outline FILE_STORAGE=local en el mismo dominio que la aplicación Outline, se puede cargar una carga útil maliciosa como un archivo adjunto y omitir esas restricciones de CSP, permitiendo la ejecución de scripts dentro del contexto de otro usuario. Esto se ha corregido en la versión 0.84.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "outline",
          "product": "outline",
          "versions": [
            {
              "version": ">= 0.72.0, < 0.84.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-03T13:46:57.802702Z",
          "id": "CVE-2025-58351",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getoutline:outline:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "0.72.0",
              "versionEndExcluding": "0.84.0",
              "matchCriteriaId": "1060B3A4-4716-4849-B852-ED0BC56727C6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/outline/outline/commit/18bc93c9c207329244c6909606a2393e863892a3",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/outline/outline/releases/tag/v0.84.0",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/outline/outline/security/advisories/GHSA-gcj7-c9jv-fhgf",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}