HTML Injection in LiquidFiles File View Endpoint

Publication date: 2026-07-07

Last updated on: 2026-07-07

Assigner: MITRE

Description

An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-07

Last Modified

2026-07-07

Generated

2026-07-08

AI Q&A

2026-07-08

EPSS Evaluated

N/A

NVD

CVE-2026-36163

EUVD

EUVD-2026-42153

Affected Vendors & Products

Vendor	Product	Version / Range
liquidfiles	liquidfiles	4.2.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an HTML injection issue found in the file view endpoint of LiquidFiles version 4.2.7. It allows authenticated attackers to upload a specially crafted HTML file that, when interacted with by a user, can execute arbitrary JavaScript code within the victim's browser.

Impact Analysis

The impact of this vulnerability is that an attacker can execute arbitrary JavaScript in the context of a victim's browser. This can lead to various malicious actions such as stealing session cookies, performing actions on behalf of the user, or redirecting the user to malicious sites, potentially compromising user data and security.

Hi! I’m here to help you understand CVE-2026-36163. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70