CVE-2026-36163 | THREATINT

Description

An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated attackers to execute arbitrary JavaScript in the context of the victim's browser via the uploading of and user interaction with a crafted HTML file.

PUBLISHED Reserved 2026-04-06 | Published 2026-07-07 | Updated 2026-07-09 | Assigner mitre

References

securing.pl/...ing-csp-to-exploit-stored-xss-in-liquidfiles/ exploit

docs.liquidfiles.com/release_notes/version_4-2-x.html

securing.pl/...ing-csp-to-exploit-stored-xss-in-liquidfiles/

cve.org (CVE-2026-36163)

nvd.nist.gov (CVE-2026-36163)

Download JSON