LiquidFiles vulnerabilities
3 known CVE vulnerabilities in LiquidFiles, translated and rated.
- CVE-2026-36163Medium
An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file.
- CVE-2026-36162Medium
An authenticated stored XSS vulnerability was found in LiquidFiles v4.2.7 in the Upload File Shares API. An attacker can inject malicious JavaScript or HTML into the Name parameter, which will be executed in other users' browsers.
- CVE-2026-12673Medium
Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability allowing privilege escalation from an Admin in a secondary domain to a Sysadmin by modifying a group in their managed secondary group.