CVE-2026-30952

HIGH

liquidjs < 10.25.0 - Path Traversal via Layout, Render, and Include Tags

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-30952. PoCs published by XiaomingX, MorielHarush.

AI-analyzed exploit summary This repository contains a functional Proof of Concept (PoC) for CVE-2026-30952, a path traversal vulnerability in the `liquidjs` library. The exploit demonstrates arbitrary file access via the `include` tag with absolute paths, bypassing the `root` directory restriction.

Description

liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0.

Exploits (2)

github WORKING POC 10 stars
by XiaomingX · pythonpoc
https://github.com/XiaomingX/data-cve-poc-py-v1/tree/main/2026/CVE-2026-30952

This repository contains a functional Proof of Concept (PoC) for CVE-2026-30952, a path traversal vulnerability in the `liquidjs` library. The exploit demonstrates arbitrary file access via the `include` tag with absolute paths, bypassing the `root` directory restriction.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: liquidjs < 10.25.0
No auth needed
Prerequisites: Node.js installed · Vulnerable version of `liquidjs` (e.g., 10.24.0)
devstral-2 · analyzed Mar 12, 2026 Full analysis →
nomisec WORKING POC
by MorielHarush · poc
https://github.com/MorielHarush/CVE-2026-30952-PoC

This repository contains a functional Proof of Concept (PoC) for CVE-2026-30952, a path traversal vulnerability in the `liquidjs` library. The exploit demonstrates arbitrary file access via the `include` tag with absolute paths, bypassing the `root` directory restriction.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: liquidjs < 10.25.0
No auth needed
Prerequisites: Node.js installed · Vulnerable version of `liquidjs` (e.g., 10.24.0)
devstral-2 · analyzed Mar 11, 2026 Full analysis →

Scores

CVSS v3 7.5
EPSS 0.0002
EPSS Percentile 6.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (2)
liquidjs/liquidjs < 10.25.0
npm/liquidjs 0 - 10.25.0npm
Published Mar 10, 2026
Tracked Since Mar 11, 2026