# CVE-2026-30952: liquidjs path traversal in file resolution fallback

Source: https://junglewise.ai/threats/cve-2026-30952-liquidjs-path-traversal-in-file-resolution-fallback  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-30952 · Severity: medium · CVSS 4 · Published 2026-03-10

LiquidJS is a template engine library used in web applications to render dynamic content. The library's layout, render, and include tags can be exploited to access arbitrary files on the server when malicious users control template content or file paths. An attacker could read sensitive configuration files, source code, or other protected data, leading to exposure of confidential information and potential further system compromise.

Technologies: [liquidjs (npm)](https://junglewise.ai/threats/technologies/liquidjs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-30952 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30952 being exploited in the wild.

**How severe is CVE-2026-30952?** Medium severity, with a CVSS score of 4, published 10 March 2026.

**Which products and versions are affected?** liquidjs (npm) SEMVER:introduced=0,fixed=10.25.0.

**Is there a fix for CVE-2026-30952?** Yes. liquidjs (npm): upgrade to 10.25.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-30952 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-30952?** Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- liquidjs (npm): upgrade to 10.25.0 or later

  ```sh
  npm install liquidjs@10.25.0
  ```


## Technical details

This is a path traversal vulnerability (CWE-22) in LiquidJS's file resolution mechanism. The root cause is that the library uses require.resolve() as a fallback method for locating template files but does not properly restrict resolution to an allowed directory root. The layout, render, and include tags accept both absolute file paths as string literals and paths via Liquid variables (with dynamicPartials enabled by default). An attacker controlling template content or file path variables can resolve and read arbitrary files on the filesystem. The vulnerability is fixed in version 10.25.0, which adds directory containment checks (checking if resolved paths are within allowed directories) before yielding file paths. Affected versions prior to 10.25.0 are vulnerable when templates or file paths come from untrusted sources.

## Affected products

- LiquidJS liquidjs < 10.25.0

## Identifiers

- CVE-2026-30952
- GHSA-wmfp-5q7x-987x

## Timeline

- 2026-03-10: disclosed
- 2026-03-10: patched: Version 10.25.0 released with fix

## References

- [https://github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x](https://github.com/harttle/liquidjs/security/advisories/GHSA-wmfp-5q7x-987x)

## Related threats

- [LiquidJS ownPropertyOnly bypass via inherited array indices](https://junglewise.ai/threats/cve-2026-106120-liquidjs-is-a-shopify-github-pages-compatible-template-engine-in)
- [LiquidJS join filter uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-69222-liquidjs-uncontrolled-resource-consumption-in-join-filter)
- [LiquidJS infinite loop in strip_html filter](https://junglewise.ai/threats/cve-2026-61556-liquidjs-infinite-loop-in-strip-html-filter)
- [LiquidJS remote code execution via crafted templates](https://junglewise.ai/threats/cve-2026-45618-liquidjs-remote-code-execution-via-crafted-templates)
- [LiquidJS memory limit bypass in pop array filter](https://junglewise.ai/threats/cve-2026-55575-liquidjs-memory-limit-bypass-in-pop-array-filter)