Vulnerability details
CVE-2026-30952
harttle liquidjs
liquidjs has a path traversal fallback vulnerability
CVSS 4.0
8.7High
Official description
liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| harttle | liquidjs | < 10.25.0 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x x_refsource_CONFIRM
- https://github.com/harttle/liquidjs/pull/851 x_refsource_MISC
- https://github.com/harttle/liquidjs/pull/855 x_refsource_MISC
- https://github.com/harttle/liquidjs/commit/3cd024d652dc883c46307581e979fe32302adbac x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-03-10
- Last updated
- 2026-03-11
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.61%
Probability of exploitation in 30 days
49.7%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')