CVE-2026-36162
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
An authenticated stored XSS vulnerability was found in LiquidFiles v4.2.7 in the Upload File Shares API. An attacker can inject malicious JavaScript or HTML into the Name parameter, which will be executed in other users' browsers.
Risk Assessment
The risk includes session theft, account takeover, or unauthorized actions performed in the context of user sessions. This could lead to sensitive data leakage and system integrity compromise.
Recommendation
Upgrade LiquidFiles to the latest patched version immediately. As a temporary measure, restrict API access to trusted users and implement server-side input validation.
Other vulnerabilities in LiquidFiles
See all- CVE-2026-36163Medium
An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file.
- CVE-2026-12673Medium
Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability allowing privilege escalation from an Admin in a secondary domain to a Sysadmin by modifying a group in their managed secondary group.
Original NVD description (English source)
An authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 allows attackers to execute arbitrary Javascript or HTML via injecting a crafted payload into the Name parameter.