8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30952

CVE-2026-30952: liquidjs has a path traversal fallback vulnerability

liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30952

CVE-2026-30952:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
liquidjs	npm	< 10.25.0	10.25.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided commit 3cd024d652dc883c46307581e979fe32302adbac clearly indicates that the vulnerability lies within the candidates function of the Loader class in src/fs/loader.ts. The vulnerability description explains that layout, render, and include tags are affected, and these tags would use the Loader to resolve file paths. The patch introduces a new function isAllowed which checks if a given path is within the configured root directories. This check is then applied to all file paths yielded by the candidates generator function, including the one returned by fs.fallback. The previous implementation was missing this check for the fallback path, which created the path traversal vulnerability. Therefore, any runtime profile during exploitation would show the Loader.candidates function as a key indicator.

Vulnerable functions

Loader.candidates

src/fs/loader.ts

The `candidates` function in the `Loader` class is responsible for resolving file paths for inclusion in templates. The vulnerability existed because the function would yield a path from the `fs.fallback` function without verifying that the path was within the allowed root directories (`enforceRoot`). This allowed an attacker to craft a path that, when passed to `fs.fallback`, would resolve to an arbitrary file on the filesystem, leading to a path traversal vulnerability. The patch fixes this by adding the `isAllowed` check to the fallback path.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.