Unrated severityNVD Advisory· Published Jul 7, 2026· Updated Jul 9, 2026

CVE-2026-36163

Description

An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file.

Affected products

Liquidjs/Liquidfilesllm-create
Range: <4.2.7

Patches

Vulnerability mechanics

References

docs.liquidfiles.com/release_notes/version_4-2-x.htmlmitre
securing.pl/en/bypassing-csp-to-exploit-stored-xss-in-liquidfiles/mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000