A configuration flaw in LiquidJS allows callers of renderFile() or parseFile() to bypass the documented root restriction when the root is set to an empty directory. The flaw permits reading the content of any file on the filesystem accessible to the running process. This leads to a confidentiality breach, exposing sensitive files such as configuration, source code, or secrets, and can compromise system integrity if the read files are subsequently processed or executed. The weakness is a classic local file read exploitation, identified as CWE-22.

The vulnerability affects the Harttle LiquidJS library, specifically versions prior to 10.25.3. Applications that use LiquidJS 10.25.0‑10.25.2 and configure the root directory as an empty string are susceptible.

The CVSS v3 score of 6.3 classifies the issue as Medium severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting a lower public exploitation risk. However, the flaw is exploitable locally by an attacker who can influence the root configuration or supply parameters to renderFile()/parseFile(). Once the flaw is reached, any file readable by the application process can be extracted. There is no evidence of network‑based exploitation vectors; the attack vector is inferred to require local or application‑level access.