Executive brief
LiquidJS is a JavaScript template engine used for rendering dynamic content in web applications. A vulnerability allows attackers who can place symlinks within trusted template directories to bypass path restrictions and read arbitrary files from the filesystem, potentially exposing sensitive data. This impacts applications that allow user-uploaded themes or templates.
Technical details
The vulnerability is a path traversal/symlink bypass (CWE-61) in LiquidJS's handling of template inclusion via {% include %}, {% render %}, and {% layout %} directives. LiquidJS validates that requested template paths are within configured root directories using string-based path comparisons rather than resolving canonical filesystem paths (realpath). When a template file is actually a symlink to an external path, the filesystem follows the symlink during file open, allowing access to files outside the intended root. Exploitation requires the ability to place symlinks or influence template files within a trusted root directory (e.g., uploaded themes, extracted archives, or mounted content). An attacker can render external files and potentially expose their contents. The vulnerability was patched in version 10.25.3 by implementing realpath-based containment checks.
Affected products
- harttle liquidjs <=10.25.2
Timeline
- 2026-04-08: disclosed
- 2026-04-06: patched: Fixed in version 10.25.3