CVE-2026-36162: LiquidFiles Stored XSS in File Shares API (v4.2.7)

Technical summary

CVE-2026-36162 is a stored cross-site scripting (XSS) vulnerability in the Upload File Shares API endpoint of LiquidFiles v4.2.7. The Name parameter fails to properly sanitize user input before storing and rendering the value to other authenticated users. This CWE-79 violation permits injection of arbitrary JavaScript or HTML that executes in victim browsers within the security context of the LiquidFiles application. The vulnerability requires prior authentication and user interaction (viewing a share), limiting but not eliminating risk in multi-user environments.

Business impact

Organizations using LiquidFiles v4.2.7 face insider-threat and account-compromise risks. A malicious or compromised internal user can create file shares designed to harvest credentials, steal session tokens, or trigger unauthorized API calls from other users' authenticated sessions. In regulated environments, successful exploitation could expose sensitive data during file sharing workflows. The impact scales with the number of trusted users who interact with malicious shares.

Affected systems

LiquidFiles version 4.2.7 is affected. Organizations should verify their exact LiquidFiles deployment version and check vendor security advisories for the full list of affected and patched versions.

Exploitability

Exploitation requires valid LiquidFiles credentials and relies on social engineering or trust to make victims view a malicious share. The attack is not remotely triggerable without authentication, and there is no evidence of active public exploitation (KEV status: not listed). The barrier to entry is moderate—any authenticated user can craft a payload, but successful impact depends on victim interaction and application context.

Remediation

Apply vendor-provided security updates immediately. LiquidFiles administrators should prioritize patching this version in their maintenance schedule. As a compensating control, implement strict input validation on file share names at the application level if patching is delayed, and monitor for suspicious share creation patterns. Review access logs for file share creation and viewing activity during the patching window.

Patch guidance

Consult the LiquidFiles vendor security advisory and release notes to identify patched versions that address CVE-2026-36162. Apply the recommended patch version to all affected LiquidFiles instances. Test the update in a staging environment before production deployment to ensure compatibility with custom integrations or API consumers.

Detection guidance

Monitor LiquidFiles application logs for File Shares API calls containing unusual characters, script tags, or event handlers in the Name parameter (e.g., <script>, onerror=, onload=). Alert on share creation events with suspicious payloads. Review access logs to identify which users have viewed shares created shortly before a detection event. Check browser console logs or network traffic for unexpected script execution originating from the LiquidFiles domain.

Why prioritize this

This vulnerability merits prompt attention due to its presence in a file-sharing system where trust and data integrity are critical. Although authentication is required, internal users with valid credentials represent a realistic threat model. The stored nature of the payload means every subsequent viewer faces risk without additional user action beyond normal platform usage. Medium CVSS score reflects the layered mitigations (authentication + user interaction), but the business context elevates practical urgency.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects an authenticated attack vector (PR:L), low attack complexity, network accessibility, and low confidentiality and integrity impact with no availability impact. The cross-site request forgery potential (S:C scope change) moderates what would otherwise be a lower score. The score does not account for organizational context, trusted-user assumption violations, or the persistence of stored XSS; risk leaders should apply local context when setting internal prioritization.

Frequently asked questions