liquidjs has a path traversal fallback vulnerability

Description

The layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default).

Recommendation

Update the liquidjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 10.25.0
• Patched version(s): 10.25.0

References

• GHSA-wmfp-5q7x-987x
• CVE-2026-30952
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• SillyTavern has a Path Traversal issue - CVE-2026-44650
• Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory read - CVE-2026-40163
• Rollup 4 has Arbitrary File Write via Path Traversal - CVE-2026-27606
• i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters - CVE-2026-42353

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Exploiting Server Version Disclosure

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

liquidjs