Critical severity · published Nov 25, 2020
CVE-2020-29071
An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19
9.0
CVSS
1.7%
EPSS
No
On KEV
Description
An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering of HTML files uploaded to the platform as attachments, when the -htmlview URL is directly accessed. The impact ranges from executing commands as root on the server to retrieving sensitive information about encrypted e-mails, depending on the permissions of the target user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Liquidfiles · Liquidfiles
before 3.3.19 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-29071
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-29071
Exploit
https://lean0x2f.github.io/liquidfiles_advisory
Release Notes
https://man.liquidfiles.com/release_notes/version_3-3-x.html
More from Liquidfiles
8.8
CVE-2025-46093
LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging the Actionscript…
8.8
CVE-2021-43397
LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin
7.3
CVE-2025-56132
LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality
6.1
CVE-2023-4393
HTML and SMTP Injection in LiquidFiles
6.1
CVE-2020-29072
A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19