CVE-2026-36163
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file.
Risk Assessment
The risk involves potential session theft, credential interception, or other malicious actions performed on behalf of the victim, which could compromise data confidentiality and integrity within the organization.
Recommendation
It is recommended to immediately upgrade LiquidFiles to the latest patched version and implement input filtering and sanitization mechanisms for uploaded HTML files.
Other vulnerabilities in LiquidFiles
See all- CVE-2026-36162Medium
An authenticated stored XSS vulnerability was found in LiquidFiles v4.2.7 in the Upload File Shares API. An attacker can inject malicious JavaScript or HTML into the Name parameter, which will be executed in other users' browsers.
- CVE-2026-12673Medium
Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability allowing privilege escalation from an Admin in a secondary domain to a Sysadmin by modifying a group in their managed secondary group.
Original NVD description (English source)
An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file.