CVE-2026-35525

OVERVIEW CVE-2026-35525 is a path traversal vulnerability in LiquidJS, a Shopify and GitHub Pages-compatible template engine written in JavaScript. The flaw affects versions prior to 10.25.3 and allows attackers to bypass directory containment checks for template inclusion operations, potentially exposing files outside the intended template root directory. This vulnerability is particularly concerning in environments where users can upload themes, extract archives, or otherwise control files within trusted template directories. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The attack exploits a logic flaw in LiquidJS's path validation mechanism, which performs string-based path checks rather than resolving actual filesystem paths. This allows attackers to use symlinks to redirect template rendering operations to arbitrary files, potentially achieving confidentiality breaches through unauthorized information disclosure. The vulnerability does not enable code execution, modification of content, or service disruption. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, with an EPSS score of 0.0005 indicating minimal exploitation probability. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog. Community attention appears limited, and no publicly available exploit code has been identified, suggesting the issue remains relatively contained within the security community.