The vulnerability occurs when Outline's JSON import feature processes the attachments[].key value without sanitization. During import, the value is joined to the server's root path and read directly via fs.readFile. An attacker who can supply a crafted JSON payload containing path traversal sequences such as '../' or an absolute path can read any file located under the server's accessible file system. This results in a confidential data leak, with the risk that sensitive files, configuration data, or secrets may be exfiltrated. The weakness falls under the Common Weakness Enumeration CWE-22: Path Traversal.

Outline, the collaborative documentation platform, is affected whenever a version earlier than 1.4.0 is in use. The security advisory identifies version 1.4.0 as the release that fixes the issue.

The CVSS base score is 5.5, indicating moderate severity, while the EPSS score is less than 1%, showing that current exploitation likelihood is low and the vulnerability is not included in CISA's KEV catalog. Exploitation requires the ability to submit a JSON import payload; therefore the attack surface is limited to users who have access to the import endpoint or to those who can influence that process. Administrators should determine whether the import function is exposed to external users before evaluating immediate risk.