AIKIDO-2026-10782
python-liquid is vulnerable to Path Traversal
75
High Risk
This Affects:
python-liquidTL;DR
Filesystem loaders joined attacker-influenceable template identifiers onto configured search directories without blocking anchored absolute paths, letting POSIX path joining discard the intended root and open unintended locations while still passing the historic dot-segment guard. They also accepted non-file paths where symlink hops could aim outside the declared template tree unless operators opted into explicit symlink rejection. The patch rejects absolute template paths up front, requires ordinary files, and optionally confines symlink targets within normalized roots.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
python-liquid is vulnerable to Path Traversal in versions 0.0.1 - 2.1.0.
How to fix this
Upgrade the python-liquid library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant