CVE-2026-30952

Katalog CVE

CVSS 7.5 · High EPSS 0,56%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada liquidjs. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0.

Rincian

Terbit di NVD

10 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 45,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x mitigasi · patch · advisory vendor
• https://github.com/harttle/liquidjs/commit/3cd024d652dc883c46307581e979fe32302adbac patch
• https://github.com/harttle/liquidjs/pull/851 issue tracking · patch
• https://github.com/harttle/liquidjs/pull/855 issue tracking · patch