CVE-2026-45017 Details
Description
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0.
A vulnerability exists in Python Liquid versions prior to 2.2.0, where the built-in FileSystemLoader and CachingFileSystemLoader do not properly restrict file access when given absolute paths. This flaw enables malicious template authors to include and render arbitrary files using the {% include %} and {% render %} tags. The targeted files must contain valid Liquid markup and be accessible by the application process.
Users can upgrade to Python Liquid version 2.2.0 or later, where this vulnerability is fixed. Alternatively, a custom template loader can be created by inheriting from FileSystemLoader and overriding the resolve_path() method to include the necessary path validation. This custom loader can then be used when setting up the Liquid environment.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jg-rp/liquid/security/advisories/GHSA-8p4x-wr7x-3788 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jg-rp python liquid | < 2.2.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |