CVE-2025-58351: Getoutline Outline XSS Vulnerability

CVE-2025-58351 Overview

Outline is a collaborative documentation platform used by teams for knowledge management. CVE-2025-58351 affects Outline versions 0.72.0 through 0.83.0 when deployed with the local file storage option (FILE_STORAGE=local) on the same domain as the application. The flaw allows an authenticated user to upload a malicious file attachment that bypasses Content Security Policy (CSP) and Content-Type restrictions. When another user opens the attachment, the payload executes script in the context of the Outline origin. The issue is a stored Cross-Site Scripting (XSS) condition classified as [CWE-79]. The project resolved the issue in version 0.84.0.

Critical Impact
Authenticated users on self-hosted Outline instances using local file storage can execute arbitrary JavaScript in another user's browser session, enabling account takeover and data theft.

Affected Products

Getoutline Outline 0.72.0 through 0.83.0
Self-hosted deployments configured with FILE_STORAGE=local
Instances serving uploaded attachments from the same domain as the Outline application

Discovery Timeline

2025-09-03 - CVE-2025-58351 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58351

Vulnerability Analysis

Outline added optional local file system storage starting in version 0.72.0. When administrators set FILE_STORAGE=local, uploaded attachments are served by the Outline application itself through the files.get endpoint rather than a separate object storage origin. Because attachments load from the same origin as the application, any script contained in a served file inherits the application's security context.

The files.get handler set Content-Type based on the stored metadata but did not emit a restrictive Content-Security-Policy header. An attacker with upload rights can place an HTML or SVG payload with an attacker-controlled Content-Type, bypassing both CSP and MIME-based protections. When a victim views the attachment URL, the browser renders the file and executes attacker-supplied JavaScript against the Outline origin, exposing session cookies, API tokens, and documents.

Root Cause

The root cause is a missing output security header on the file-serving endpoint combined with same-origin delivery of untrusted user content. The handler in plugins/storage/server/api/files.ts wrote Content-Type and Cache-Control headers but did not isolate attachment responses from the main application context.

Attack Vector

Exploitation requires an authenticated account with permission to upload attachments and user interaction from a victim who opens the crafted file. The attack is network-reachable and does not require elevated privileges.

typescript

// Patch applied in plugins/storage/server/api/files.ts
     ctx.set("Accept-Ranges", "bytes");
     ctx.set("Cache-Control", cacheHeader);
     ctx.set("Content-Type", contentType);
+    ctx.set("Content-Security-Policy", "sandbox");
     ctx.attachment(fileName, {
       type: forceDownload
         ? "attachment"

Source: Outline commit 18bc93c9. The fix adds Content-Security-Policy: sandbox to responses from the files.get endpoint, forcing browsers to treat served files as untrusted and blocking script execution and same-origin access.

Detection Methods for CVE-2025-58351

Indicators of Compromise

Attachment uploads with Content-Type values of text/html, image/svg+xml, or application/xhtml+xml on local-storage Outline deployments
HTTP responses from /api/files.get lacking a Content-Security-Policy header on versions 0.72.0 through 0.83.0
Unexpected outbound requests from user browser sessions to attacker-controlled domains shortly after opening an Outline attachment

Detection Strategies

Inspect reverse proxy or application logs for requests to the files.get endpoint followed by anomalous session API calls from the same user
Review Outline attachment metadata for files with executable MIME types uploaded by low-trust accounts
Hunt for responses served from the Outline origin with HTML content types that originated as user uploads

Monitoring Recommendations

Alert on new attachment uploads where the stored Content-Type is scriptable (HTML, SVG, XML variants)
Monitor for session token reuse from unexpected IP addresses after attachment views
Track Outline version strings across self-hosted deployments to identify instances still running affected releases

How to Mitigate CVE-2025-58351

Immediate Actions Required

Upgrade self-hosted Outline instances to version 0.84.0 or later
Audit the attachment store for existing HTML, SVG, or XHTML files uploaded by non-trusted users and remove suspicious entries
Rotate session secrets and API tokens if evidence of exploitation is found

Patch Information

The fix is contained in commit 18bc93c9c207329244c6909606a2393e863892a3 and ships in Outline release v0.84.0. It adds Content-Security-Policy: sandbox to responses from the files.get endpoint. Full details are in the GitHub Security Advisory GHSA-gcj7-c9jv-fhgf.

Workarounds

Switch FILE_STORAGE to an object storage backend such as S3 served from a separate domain to isolate attachment content from the application origin
Place a reverse proxy in front of Outline that injects Content-Security-Policy: sandbox on responses from /api/files.get until the upgrade is applied
Restrict attachment upload permissions to trusted user roles only

bash

# Example nginx override until Outline is upgraded to 0.84.0
location /api/files.get {
    proxy_pass http://outline_upstream;
    proxy_hide_header Content-Security-Policy;
    add_header Content-Security-Policy "sandbox" always;
    add_header X-Content-Type-Options "nosniff" always;
}