Path Traversal Vulnerability in LiquidJS Template Engine for Shopify/GitHub

CVE-2026-35525

What is CVE-2026-35525?

LiquidJS, a template engine compatible with Shopify and GitHub Pages, has a vulnerability that allows attackers to bypass intended access controls. Before version 10.25.3, the checks for the {% include %}, {% render %}, and {% layout %} tags only validated the path as a string against the configured roots, rather than using a secure realpath check. This flaw means that if an attacker places a symbolic link in a permitted directory, LiquidJS may follow the link and render content from outside the expected directory. This could lead to unauthorized disclosure of files, particularly in environments where file uploads or themes can be controlled by users. It's crucial to upgrade to version 10.25.3 to close this security gap.

References