CVE-2026-30952

High

Published: 10 March 2026

Published

10 March 2026

Modified

18 March 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0002 5.8th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-30952 is a high-severity Path Traversal (CWE-22) vulnerability in Liquidjs Liquidjs. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation

addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1552.001 Credentials In Files Credential Access

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

attack.mitre.org →

Why these techniques?

Path traversal in public-facing template engine directly enables remote file read (T1005) including credential files (T1552.001) via T1190 exploitation of internet-facing apps.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require…

dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0.

Deeper analysisAI

CVE-2026-30952 is a path traversal vulnerability (CWE-22) in liquidjs, a Shopify- and GitHub Pages-compatible template engine implemented in pure JavaScript. Versions prior to 10.25.0 allow arbitrary file access through the layout, render, and include tags when absolute paths are specified, either as string literals or via Liquid variables. The latter requires the dynamicPartials option to be enabled, which is the default setting. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no requirements for authentication or user interaction.

Attackers can exploit this vulnerability in scenarios where untrusted users control template content or provide filepath inputs as Liquid variables. Remote, unauthenticated attackers gain read access to arbitrary files on the server by crafting malicious templates or variables with absolute paths, potentially exposing sensitive data such as configuration files, source code, or user information depending on the application's file system permissions and deployment context.

The vulnerability is addressed in liquidjs version 10.25.0, where the relevant changes prevent absolute path traversal in the affected tags. Security practitioners should upgrade to 10.25.0 or later and review applications using liquidjs for user-controlled template rendering, disabling dynamicPartials if feasible. Official details are available in the GitHub security advisory (GHSA-wmfp-5q7x-987x) and related pull requests (#851, #855) with the fixing commit (3cd024d652dc883c46307581e979fe32302adbac).