AIKIDO-2026-428396
python-liquid is vulnerable to Path Traversal
75
High Risk
This Affects:
python-liquidTL;DR
The built-in PackageLoader resolves template names supplied to the include and render tags without confining them to the configured package directory. Fully qualified or absolute names and parent-directory components escape the package base, so template authors can load and render arbitrary process-readable files that contain valid Liquid markup. Before the fix this allows disclosure of files outside the intended package directory. The fix rejects absolute paths and .. components and verifies that resolved template paths remain beneath the package directory.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application uses PackageLoader to load templates whose names can be influenced by untrusted template authors.
Background info
python-liquid is vulnerable to Path Traversal in versions 1.11.0 - 2.3.0.
How to fix this
Upgrade the python-liquid library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant