LiquidJS, a JavaScript template engine compatible with Shopify and GitHub Pages, prior to version 10.25.3, improperly limits pathname access in its renderFile() and parseFile() functions. Although the root directory is documented as a constraint, top-level file loads bypass this restriction. Consequently, when a Liquid instance is configured with an empty temporary directory as root, it can return contents of arbitrary files outside the intended directory. This constitutes a CWE-22 path traversal vulnerability. The issue is resolved in LiquidJS version 10.25.3.

An attacker can exploit this vulnerability to read arbitrary files on the system where LiquidJS is running, potentially exposing sensitive information. The vulnerability does not require privileges or user interaction and has a medium severity score of 6.3. There are no known exploits in the wild at this time.

Upgrade LiquidJS to version 10.25.3 or later, where this path traversal vulnerability is fixed. Since no official patch links or vendor advisories are provided beyond the version fix, users should verify their LiquidJS version and update accordingly. No additional mitigations are indicated.