Arbitrary File Access Vulnerability in LiquidJS Template Engine
CVE-2026-30952

8.7HIGH

Key Information:

Vendor: Harttle
Status: Liquidjs
Vendor: CVE Published:; 10 March 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-30952?

LiquidJS is a versatile template engine that is primarily compatible with Shopify and GitHub Pages, designed to simplify the rendering of dynamic content. However, prior to version 10.25.0, it contained a vulnerability that allowed malicious users to exploit the layout, render, and include tags. This flaw permitted access to arbitrary files through the use of absolute paths, either as hardcoded strings or via user-controlled Liquid variables - provided that dynamicPartials was enabled, which was the default setting. Such access poses a significant risk if unauthorized individuals are able to manipulate template content or specify arbitrary file paths. The issue has been addressed in the 10.25.0 release, highlighting the importance of updating to safeguard against potential exploits.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

liquidjs < 10.25.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-30952-PoC
Created by MorielHarush