CVE-2026-45017

Katalog CVE

CVSS 7.5 · High EPSS 0,50%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada jg-rp python liquid. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0.

Rincian

Terbit di NVD

28 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jg-rp/liquid/security/advisories/GHSA-8p4x-wr7x-3788 mitigasi · advisory vendor