CVE-2026-30952
Arbitrary File Access in LiquidJS Template Engine Prior to
Publication date: 2026-03-10
Last updated on: 2026-03-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| liquidjs | liquidjs | to 10.25.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in liquidjs, a JavaScript template engine compatible with Shopify and GitHub Pages. Before version 10.25.0, the layout, render, and include tags allowed arbitrary file access using absolute paths. This could happen either through string literals or Liquid variables (when dynamicPartials is enabled, which is the default).
If a malicious user can control the template content or specify the filepath as a Liquid variable, they could exploit this to access arbitrary files on the system.
This security risk was addressed and fixed in version 10.25.0 of liquidjs.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to arbitrary files on the server where liquidjs is used. If exploited, an attacker could read sensitive files, potentially exposing confidential information or system data.
Since the vulnerability allows file access without any privileges or user interaction, it poses a high security risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade liquidjs to version 10.25.0 or later, where the arbitrary file access issue via layout, render, and include tags has been fixed.