liquidjs hat eine Path-Traversal-Fallback-Schwachstelle

The core of the vulnerability lies in liquidjs's handling of file paths within its layout, render, and include tags. The require.resolve() function is used as a fallback mechanism, but it lacks sufficient restrictions on the directories it can resolve. This allows an attacker, particularly if they can control template content or specify filepaths via Liquid variables (requiring dynamicPartials: true, which is the default setting), to craft malicious requests that access files outside of the intended template directory. Successful exploitation could lead to the disclosure of sensitive configuration files, source code, or other critical data stored on the server. The blast radius extends to any application utilizing liquidjs with vulnerable configurations.

Applications built on Node.js that utilize liquidjs for templating, particularly those with default configurations enabling dynamicPartials: true or allowing user-controlled template content, are at risk. Shared hosting environments where multiple applications share the same server and file system are also particularly vulnerable, as a compromise in one application could potentially lead to access to files belonging to others.

• nodejs / server:

  ps aux | grep liquidjs
  find / -name "liquidjs" -type d 2>/dev/null

• generic web:

  curl -I 'http://your-application.com/templates/include?file=../../../../etc/passwd' # Attempt to access sensitive files
  grep -r 'require.resolve' /path/to/your/application/node_modules/liquidjs/

1. 2026-03-10Disclosure

   disclosure

1. Reserviert2026-03-07
2. Veröffentlicht2026-03-10
3. Geändert2026-03-17
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-30952 is to upgrade to liquidjs version 10.25.0 or later, which addresses the root cause of the vulnerability. If upgrading immediately is not feasible, consider implementing a Web Application Firewall (WAF) or proxy rules to filter requests containing suspicious file paths or patterns within the layout, render, and include tags. Carefully review and sanitize any user-supplied input used in template rendering to prevent malicious file path manipulation. Disable dynamicPartials: true if it is not essential for your application’s functionality. After upgrading, confirm the fix by attempting to access arbitrary files via the vulnerable tags and verifying that access is denied.