CVE-2026-45017— Python Liquid 路径遍历漏洞

Python Liquid: Absolute paths escape filesystem loader search path

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and render arbitrary files via the {% include %} and {% render %} tags. Targeted files would need to contain valid Liquid markup and be readable by the application process. This vulnerability is fixed in 2.2.0.

N/A

对路径名的限制不恰当(路径遍历)

Python Liquid 路径遍历漏洞

Python Liquid是James个人开发者的一个用于处理Liquid模板的Python引擎。 Python Liquid 2.2.0之前版本存在路径遍历漏洞，该漏洞源于FileSystemLoader和CachingFileSystemLoader未防止绝对路径读取，允许恶意模板作者加载和渲染任意文件。

N/A

N/A