# CVE-2026-36162: LiquidFiles stored XSS in Upload File Shares API

Source: https://junglewise.ai/threats/cve-2026-36162-liquidfiles-stored-xss-in-upload-file-shares-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-36162 · Severity: info · CVSS 0 · Published 2026-07-07

LiquidFiles is a secure file transfer appliance used by government and healthcare organizations to share sensitive data. A security flaw in the file sharing interface allows an authenticated user to inject malicious scripts into the system. If an administrator views the activity logs containing these scripts, the attacker could potentially take full control of the appliance, access all stored files, or disrupt the service.

Technologies: [LiquidFiles](https://junglewise.ai/threats/technologies/liquidfiles). Vendors: [LiquidFiles](https://junglewise.ai/threats/vendors/liquidfiles).

## Quick answers

**Is CVE-2026-36162 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36162 being exploited in the wild.

**How severe is CVE-2026-36162?** Informational severity, with a CVSS score of 0, published 7 July 2026.

**Which products and versions are affected?** LiquidFiles 4.2.7 and prior.

**Is there a fix for CVE-2026-36162?** A patch was published on 2026-07-07: Remediation available in version 4.2.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-36162 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-36162?** Check whether you run LiquidFiles at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Upload File Shares API of LiquidFiles v4.2.7. The vulnerability is rooted in the 'Name' parameter of the JSON-based file upload path, which is subsequently rendered without proper HTML encoding in the activity log when a file is renamed. While the application employs a strict Content Security Policy (CSP), researchers discovered that certain routes served via Nginx (such as file previews) omit CSP headers. An attacker can chain this XSS with a meta-refresh redirect to an uploaded malicious HTML file, bypassing CSP and Referer header validations. Successful exploitation by a low-privileged user against an administrator can lead to full instance compromise. The issue is addressed in version 4.2.8.

## Affected products

- LiquidFiles LiquidFiles 4.2.7 and prior

## Timeline

- 2026-07-01: disclosed: Vulnerability details published by Securing.pl researchers.
- 2026-07-07: advisory: CVE-2026-36162 published to the NVD.
- 2026-07-07: patched: Remediation available in version 4.2.8.

## References

- [https://docs.liquidfiles.com/release_notes/version_4-2-x.html](https://docs.liquidfiles.com/release_notes/version_4-2-x.html)
- [https://securing.pl/en/bypassing-csp-to-exploit-stored-xss-in-liquidfiles/](https://securing.pl/en/bypassing-csp-to-exploit-stored-xss-in-liquidfiles/)

## Related threats

- [LiquidFiles HTML injection in file view endpoint](https://junglewise.ai/threats/cve-2026-36163-liquidfiles-html-injection-in-file-view-endpoint)
- [LiquidFiles privilege escalation from Domain Admin to SysAdmin](https://junglewise.ai/threats/cve-2026-12673-liquidfiles-privilege-escalation-from-domain-admin-to-sysadmin)