CVE-2026-36162: LiquidFiles Stored XSS Vulnerability

CVE-2026-36162 Overview

CVE-2026-36162 is an authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of LiquidFiles v4.2.7. Attackers with valid credentials can inject a crafted payload into the Name parameter to execute arbitrary JavaScript or HTML in the browsers of other users who view the affected resource. The flaw is tracked under CWE-79 and stems from insufficient output encoding of user-supplied file share metadata. Because the payload persists on the server, it triggers automatically for every user who loads the affected view, enabling session theft, credential capture, and targeted actions performed as the victim.

Critical Impact
Authenticated attackers can persistently inject JavaScript that executes in other users' browser sessions, including administrators, by tampering with the Name parameter of the Upload File Shares API.

Affected Products

LiquidFiles v4.2.7
LiquidFiles v4.x releases prior to the 4.2.x fix noted in the vendor release notes
Deployments exposing the Upload File Shares API to authenticated users

Discovery Timeline

2026-07-07 - CVE-2026-36162 published to the National Vulnerability Database
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-36162

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the Upload File Shares API of LiquidFiles v4.2.7. The API accepts a Name parameter as part of the file share creation workflow. The application stores this value and later renders it in the web UI without sufficient contextual output encoding. When a victim loads a page that displays the attacker-controlled name, the injected markup is parsed by the browser and executes in the victim's session.

Exploitation requires only low-privilege authentication and user interaction from a victim who views the tampered share. Because the payload is server-side persistent, it survives across sessions and triggers automatically. Public analysis by Securing.pl demonstrates that the Content Security Policy shipped with LiquidFiles can be bypassed, allowing the injected script to reach full execution rather than being blocked at the browser layer. See the Securing.pl XSS Exploit Analysis for the detailed exploitation walkthrough.

Root Cause

The root cause is missing or incomplete output encoding of the Name field before it is rendered into an HTML context. User-supplied metadata is treated as trusted markup rather than as inert text. The accompanying Content Security Policy did not sufficiently restrict inline execution paths, which meant the encoding gap could be reached in practice.

Attack Vector

The attack vector is network-based and requires an authenticated account plus one victim interaction. An attacker submits a POST to the Upload File Shares API with a Name value containing JavaScript or HTML markup, for example an <img> tag with an onerror handler or a <script> block. The value is persisted to the file share record. Any user who later opens the share in the LiquidFiles UI triggers execution of the payload under the LiquidFiles origin, granting the attacker read and write access to the victim's session context.

No verified proof-of-concept code is published in the primary CVE record. Technical exploitation details are documented in the Securing.pl XSS Exploit Analysis.

Detection Methods for CVE-2026-36162

Indicators of Compromise

File share records where the Name field contains HTML control characters such as <, >, ", or event handler substrings like onerror=, onload=, or javascript:.
Web server access logs showing POST requests to the Upload File Shares API endpoint with unusually long or markup-laden Name parameters.
Browser-side Content Security Policy violation reports originating from LiquidFiles pages that render file share listings.
Unexpected outbound requests from authenticated user sessions to attacker-controlled domains shortly after opening a shared file view.

Detection Strategies

Inspect stored file share records for Name values that fail strict allow-list validation for printable, non-markup characters.
Deploy web application firewall rules that flag XSS payload signatures in requests to the Upload File Shares API.
Correlate authenticated API calls that create shares with subsequent anomalous session behavior from users who accessed those shares.
Enable and review CSP violation reporting to surface script execution attempts that were partially blocked.

Monitoring Recommendations

Alert on file share creation events where the Name parameter contains angle brackets, quotes, or known XSS keywords.
Monitor for administrator account sessions performing unexpected privileged actions immediately after viewing user-submitted shares.
Track outbound HTTP requests from browsers rendering LiquidFiles pages toward untrusted external hosts.

How to Mitigate CVE-2026-36162

Immediate Actions Required

Upgrade LiquidFiles to the fixed 4.2.x release as documented in the LiquidFiles Release Notes 4.2.x.
Audit existing file share records for Name values containing HTML or JavaScript markup and sanitize or remove them.
Rotate session tokens and administrative credentials for any user who may have viewed a malicious share.
Restrict Upload File Shares API access to trusted user groups where operationally feasible.

Patch Information

The vendor addressed the issue in the LiquidFiles 4.2.x maintenance line. Administrators should review the LiquidFiles Release Notes 4.2.x to confirm the target build and apply the update to all affected appliances. Verify the version after upgrade and re-test the Upload File Shares workflow to confirm that markup submitted in the Name parameter is rendered as inert text.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources until the patched version is deployed.
Apply input validation at a reverse proxy or WAF to reject requests to the Upload File Shares API whose Name parameter contains <, >, or javascript:.
Limit the set of authenticated users permitted to create file shares to reduce the exploitable population.

bash

# Example WAF rule (ModSecurity) blocking markup in the Name parameter
SecRule ARGS:Name "@rx (?i)(<script|onerror=|onload=|javascript:|<img|<svg)" \
    "id:1026362,phase:2,deny,status:400,log,\
     msg:'CVE-2026-36162 XSS payload in LiquidFiles Name parameter'"