CVE-2026-36163: HTML Injection in LiquidFiles v4.2.7 File View Endpoint

Technical summary

CVE-2026-36163 is a cross-site scripting (XSS) vulnerability classified as CWE-79 HTML injection. The vulnerability exists in LiquidFiles v4.2.7's file view endpoint, where user-supplied HTML from uploaded files is rendered without adequate input validation or output encoding. The attack requires prior authentication and user interaction—specifically, a victim must view the malicious HTML file—but the attack surface is cross-site in scope, meaning the injected script runs with the privileges of the viewing user's session. The CVSS v3.1 score of 5.4 (MEDIUM) reflects low attack complexity and network accessibility, balanced against the requirement for valid credentials and user action.

Business impact

An attacker with valid LiquidFiles credentials could plant HTML payloads in shared files to harvest credentials, session cookies, or sensitive data viewed by colleagues. This is particularly damaging in collaborative environments where files are routinely shared across teams. The attack undermines trust in file-sharing workflows and may expose confidential information handled through the platform. Organizations relying on LiquidFiles for secure document exchange face potential data leakage and compliance violations if user sessions are compromised.

Affected systems

LiquidFiles v4.2.7 is confirmed vulnerable. Organizations running this version with file-sharing or file-viewing features enabled should assume exposure. Earlier and later versions require vendor confirmation; consult the official LiquidFiles security advisory to determine the full affected range and any available patched versions.

Exploitability

Exploitation is moderately straightforward. An attacker needs valid authentication credentials—either their own account or a compromised one—to upload a malicious HTML file. The victim must then view or open the file within LiquidFiles. No network-level access controls or zero-click delivery mechanisms are involved. Because the attack is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, there is no evidence yet of active weaponization, but the relative simplicity of the attack vector warrants rapid remediation.

Remediation

Apply the vendor's patched version of LiquidFiles as soon as it becomes available. Verify the patch version against the official LiquidFiles security advisory. As interim mitigations, restrict file upload permissions to trusted users, educate staff to avoid opening untrusted HTML files from colleagues, and consider disabling in-browser HTML preview if operationally feasible. Monitor file uploads for suspicious HTML attachments containing script tags.

Patch guidance

Consult the official LiquidFiles vendor advisory for the specific patched version number and installation instructions. Patches typically involve output encoding of HTML content and stricter input validation in the file view endpoint. Test patches in a non-production environment before rolling out to production instances. Verify that file preview and download functionality remain intact after patching.

Detection guidance

Monitor for uploaded files with .html or .htm extensions, especially those containing script, iframe, or event handler tags. Review web server access logs for anomalous file view requests or repeated access to uploaded HTML files by different users. Inspect browser console errors or XSS-related alerts if your web application firewall (WAF) is configured to detect reflected or stored XSS patterns. Conduct a review of recent file uploads in your LiquidFiles instance to identify any suspicious HTML files already in circulation.

Why prioritize this

Although CVSS 5.4 is rated MEDIUM, the vulnerability's presence in a file-sharing platform—where collaboration and trust are core functions—elevates practical risk. Stored XSS in shared files can compromise multiple users and persist until remediated. The requirement for authentication and user interaction, while reducing the attack surface compared to unauthenticated XSS, does not eliminate risk in insider-threat scenarios or if attacker credentials are obtained via phishing. Organizations using LiquidFiles for handling sensitive intellectual property or regulated data should prioritize patching.

Risk score, explained

The CVSS 5.4 score reflects a network-accessible, low-complexity attack (AV:N/AC:L) that requires valid user privileges (PR:L) and user interaction (UI:R). The scope is changed (S:C), meaning the vulnerability can affect resources beyond the vulnerable component—in this case, other users' browser sessions. Confidentiality and integrity are impacted (C:L/I:L), but availability is not (A:N). This places the vulnerability in the MEDIUM band. However, the stored nature of the payload and its presence in a trust-critical file-sharing context may justify elevated internal risk scores depending on your organization's threat modeling.

Frequently asked questions