# CVE-2026-36163: LiquidFiles HTML injection in file view endpoint

Source: https://junglewise.ai/threats/cve-2026-36163-liquidfiles-html-injection-in-file-view-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-36163 · Severity: info · CVSS 0 · Published 2026-07-07

LiquidFiles, a file transfer appliance used by government and healthcare sectors, contains a security flaw in how it handles file previews. An authenticated attacker can upload a specially crafted file that, when viewed by another user (such as an administrator), executes malicious code in their web browser. This could allow an attacker to take over the account of the person viewing the file, potentially leading to full system compromise and the theft of sensitive data.

Technologies: [LiquidFiles](https://junglewise.ai/threats/technologies/liquidfiles). Vendors: [LiquidFiles](https://junglewise.ai/threats/vendors/liquidfiles).

## Quick answers

**Is CVE-2026-36163 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36163 being exploited in the wild.

**How severe is CVE-2026-36163?** Informational severity, with a CVSS score of 0, published 7 July 2026.

**Which products and versions are affected?** LiquidFiles 4.2.7.

**Is there a fix for CVE-2026-36163?** A patch was published on 2026-07-07: Fix available in version 4.2.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-36163 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-36163?** Check whether you run LiquidFiles at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An HTML injection vulnerability exists in the file view endpoint of LiquidFiles v4.2.7. The vulnerability arises because the application fails to properly sanitize filenames in activity logs and omits Content Security Policy (CSP) headers on certain routes served by the reverse proxy. An authenticated attacker can exploit this by uploading a malicious HTML file and using a secondary XSS gadget (such as a meta-refresh payload in a filename) to redirect a victim to the file preview. Because the preview endpoint lacks CSP protections, the injected JavaScript executes in the victim's browser context. This can lead to session hijacking or full administrative compromise if an admin views the logs. The issue is addressed in version 4.2.8.

## Affected products

- LiquidFiles LiquidFiles 4.2.7

## Timeline

- 2026-07-01: disclosed: Vulnerability details published by Securing.pl
- 2026-07-07: advisory: CVE published to NVD
- 2026-07-07: patched: Fix available in version 4.2.8

## References

- [https://docs.liquidfiles.com/release_notes/version_4-2-x.html](https://docs.liquidfiles.com/release_notes/version_4-2-x.html)
- [https://securing.pl/en/bypassing-csp-to-exploit-stored-xss-in-liquidfiles/](https://securing.pl/en/bypassing-csp-to-exploit-stored-xss-in-liquidfiles/)

## Related threats

- [LiquidFiles stored XSS in Upload File Shares API](https://junglewise.ai/threats/cve-2026-36162-liquidfiles-stored-xss-in-upload-file-shares-api)
- [LiquidFiles privilege escalation from Domain Admin to SysAdmin](https://junglewise.ai/threats/cve-2026-12673-liquidfiles-privilege-escalation-from-domain-admin-to-sysadmin)