CVE-2026-30952

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
harttle	liquidjs	< 10.25.0

References

https://github.com/harttle/liquidjs/commit/3cd024d652dc883c46307581e979fe32302adbacPatch
https://github.com/harttle/liquidjs/pull/851Issue Tracking, Patch
https://github.com/harttle/liquidjs/pull/855Issue Tracking, Patch
https://github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987xMitigation, Patch, Vendor Advisory

Timeline

Published: Mar 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-309536.5LinkAce is a self-hosted archive to collect website links. When a user creates a link via POST /links, the server fetches HTML metadata from CVE-2026-309544.3LinkAce is a self-hosted archive to collect website links. In 2.1.0 and earlier, the processTaxonomy() method in LinkRepository.php allows a CVE-2026-309556.5Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An API endpoint accepts unboun CVE-2026-309569.9OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and te CVE-2026-309579.9OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, OneUptime Synthetic Monitors allow a low-privileged a CVE-2026-309588.6OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, an unauthenticated path traversal in the /workflow/do CVE-2026-309595.0OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to CVE-2026-30964.7The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains CVE-2026-309609.4rssn is a scientific computing library for Rust, combining a high-performance symbolic computation engine with numerical methods support and CVE-2026-309614.3Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, the chunked upload completion CVE-2026-309626.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.6 and 8.6.19, t CVE-2026-309632.7Capsule is a multi-tenancy and policy-based framework for Kubernetes. To defend against namespace hijacking achieved through update/patch op