CVE-2026-36163: LiquidFiles XSS Vulnerability

CVE-2026-36163 Overview

CVE-2026-36163 is an HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7. Authenticated attackers can upload a crafted HTML file that executes arbitrary JavaScript in the victim's browser when the file is viewed. The flaw is categorized as Cross-Site Scripting (XSS) under [CWE-79]. Successful exploitation runs script in the origin of the LiquidFiles application, enabling session-context actions against the victim user.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in a victim's browser session by uploading a malicious HTML file and enticing the victim to open it through the file view endpoint.

Affected Products

LiquidFiles v4.2.7

Discovery Timeline

2026-07-07 - CVE-2026-36163 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-36163

Vulnerability Analysis

The vulnerability resides in the file view endpoint of LiquidFiles v4.2.7. When an authenticated user uploads an HTML file, the application serves the file in a manner that allows the browser to render its markup and script content within the application's origin. Because the response is not sanitized, stripped, or forced to a safe content disposition, embedded JavaScript executes in the context of the LiquidFiles domain.

The issue requires authentication and user interaction. A victim must open the attacker-supplied file for the payload to run. Once executed, the script can read session-bound data accessible to the victim, issue authenticated requests on the victim's behalf, and manipulate rendered content. Additional analysis of the exploitation path, including Content Security Policy (CSP) bypass techniques, is documented in the Securing.pl XSS Exploit Analysis.

Root Cause

The file view endpoint returns uploaded HTML content with a content type and disposition that allow inline rendering. The application does not neutralize active markup or serve the file as a non-executable attachment, so <script> blocks and event-handler attributes execute when rendered.

Attack Vector

An authenticated attacker uploads a crafted HTML file containing JavaScript. The attacker then shares or references the file so a victim opens it through the vulnerable view endpoint. When the victim's browser renders the file, the embedded script executes under the LiquidFiles origin.

No verified public exploit code is available. Refer to the Securing.pl XSS Exploit Analysis for a technical description of the payload and CSP bypass approach.

Detection Methods for CVE-2026-36163

Indicators of Compromise

Uploaded files with .html, .htm, or .svg extensions stored in LiquidFiles user file shares.
Server responses from the file view endpoint returning Content-Type: text/html for user-uploaded content.
Outbound requests from user browsers to attacker-controlled domains immediately after accessing a LiquidFiles file view URL.

Detection Strategies

Inspect LiquidFiles access logs for GET requests to the file view endpoint referencing HTML file identifiers followed by anomalous authenticated API calls from the same session.
Scan uploaded files at rest for HTML markup, <script> tags, and inline event handlers in files delivered through LiquidFiles.
Correlate file upload events with subsequent view events from different user accounts within short time windows.

Monitoring Recommendations

Alert on LiquidFiles sessions that issue account modification or file share requests immediately after loading a file view URL.
Monitor browser telemetry for JavaScript execution originating from the LiquidFiles origin against unexpected external hosts.
Track upload volumes of HTML and SVG file types per user and flag deviations from baseline.

How to Mitigate CVE-2026-36163

Immediate Actions Required

Upgrade LiquidFiles to a fixed release documented in the LiquidFiles Release Notes.
Restrict upload permissions to trusted user groups until patching is complete.
Notify users to avoid opening HTML attachments received through LiquidFiles from untrusted senders.

Patch Information

LiquidFiles has published fixes in the 4.2.x release train. Review the LiquidFiles Release Notes for the specific patched version and apply the upgrade in accordance with vendor guidance.

Workarounds

Configure the web server or reverse proxy to force Content-Disposition: attachment for user-uploaded files, preventing inline rendering.
Deny or convert HTML, HTM, and SVG uploads at the gateway until the patch is installed.
Tighten the Content Security Policy on the LiquidFiles application to remove permissive script sources referenced in the Securing.pl XSS Exploit Analysis.

bash

# Example reverse proxy directive to force download of user-uploaded files
location /files/ {
    add_header Content-Disposition "attachment" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Security-Policy "default-src 'none'; sandbox;" always;
}