Authenticated Stored XSS in LiquidFiles Upload File Shares API

Publication date: 2026-07-07

Last updated on: 2026-07-07

Assigner: MITRE

Description

An authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 allows attackers to execute arbitrary Javascript or HTML via injecting a crafted payload into the Name parameter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-07

Last Modified

2026-07-07

Generated

2026-07-08

AI Q&A

2026-07-08

EPSS Evaluated

N/A

NVD

CVE-2026-36162

EUVD

EUVD-2026-42152

Affected Vendors & Products

Vendor	Product	Version / Range
liquidfiles	liquidfiles	4.2.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an authenticated stored cross-site scripting (XSS) issue in the Upload File Shares API of LiquidFiles version 4.2.7. It allows attackers who have authentication to inject malicious JavaScript or HTML code by crafting a payload in the Name parameter.

Impact Analysis

Exploitation of this vulnerability can lead to execution of arbitrary JavaScript or HTML in the context of users interacting with the affected API. This can result in unauthorized actions, data theft, session hijacking, or other malicious activities performed by the attacker.

Hi! I’m here to help you understand CVE-2026-36162. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70