Executive brief
LiquidFiles is a secure file transfer appliance used by government and healthcare organizations to share sensitive data. A security flaw in the file sharing interface allows an authenticated user to inject malicious scripts into the system. If an administrator views the activity logs containing these scripts, the attacker could potentially take full control of the appliance, access all stored files, or disrupt the service.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Upload File Shares API of LiquidFiles v4.2.7. The vulnerability is rooted in the 'Name' parameter of the JSON-based file upload path, which is subsequently rendered without proper HTML encoding in the activity log when a file is renamed. While the application employs a strict Content Security Policy (CSP), researchers discovered that certain routes served via Nginx (such as file previews) omit CSP headers. An attacker can chain this XSS with a meta-refresh redirect to an uploaded malicious HTML file, bypassing CSP and Referer header validations. Successful exploitation by a low-privileged user against an administrator can lead to full instance compromise. The issue is addressed in version 4.2.8.
Affected products
- LiquidFiles LiquidFiles 4.2.7 and prior
Timeline
- 2026-07-01: disclosed: Vulnerability details published by Securing.pl researchers.
- 2026-07-07: advisory: CVE-2026-36162 published to the NVD.
- 2026-07-07: patched: Remediation available in version 4.2.8.