Is CVE-2026-30952 actively exploited?

No active exploitation of CVE-2026-30952 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-30952 be exploited remotely?

Yes. CVE-2026-30952 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-30952?

CVE-2026-30952 has a CVSS score of 8.7 (HIGH).

HOME VULNERABILITIESCVE-2026-30952

HIGH

CVE-2026-30952

CWE-22Published: March 10, 2026· Updated: Mar 11, 2026

8.7

CVSS v3.1

EPSS:0.06%probability of exploitation in 30 daysPercentile:19.4th

Official Description

liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render, and include tags allow arbitrary file access via absolute paths (either as string literals or through Liquid variables, the latter require dynamicPartials: true, which is the default). This poses a security risk when malicious users are allowed to control the template content or specify the filepath to be included as a Liquid variable. This vulnerability is fixed in 10.25.0.

NVD Source

Technical Analysis

CVE-2026-30952 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X