CVE-2026-30952

HIGH

liquidjs <10.25.0 - Path Traversal

Title source: llm

Description

liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0.

Exploits (2)

github WORKING POC 10 stars

by XiaomingX · pythonpoc

https://github.com/XiaomingX/data-cve-poc-py-v1/tree/main/2026/CVE-2026-30952

View Code ZIP pw:eip

nomisec WORKING POC

by MorielHarush · poc

https://github.com/MorielHarush/CVE-2026-30952-PoC

View Code ZIP pw:eip

References (4)

[Patch] https://github.com/harttle/liquidjs/commit/3cd024d652dc883c46307581e979fe32302adbac

View Patch ZIP pw:eip

[Issue Tracking] https://github.com/harttle/liquidjs/pull/851

[Issue Tracking] https://github.com/harttle/liquidjs/pull/855

[Vendor Advisory] https://github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x

Scores

CVSS v3 7.5

EPSS 0.0002

EPSS Percentile 5.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-22

Status published

Products (2)

liquidjs/liquidjs < 10.25.0

npm/liquidjs 0 - 10.25.0npm

Published Mar 10, 2026

Tracked Since Mar 11, 2026