LiquidFiles EUVD-2026-38111

Exploitation requires: (1) valid Admin-level credentials for a secondary (non-default) LiquidFiles domain - regular user accounts and primary domain accounts are not sufficient; (2) the target LiquidFiles instance must be configured with at least one secondary (non-default) domain, as the vulnerable code path is specific to non-default domain group management; (3) the attacker must be able to reach the LiquidFiles web interface over the network. Limiting factors include the requirement for pre-existing Admin credentials (PR:H), which restricts the attacker pool to insiders, compromised admin accounts, or threat actors who have already achieved a foothold with admin-level access. Default single-domain LiquidFiles deployments are not affected by this specific privilege escalation path.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N) scores 5.9 Medium, reflecting that while network-accessible, exploitation requires high existing privileges (PR:H) and a specific deployment configuration (AT:P - secondary domain setup). The impact metrics in the provided vector (VC:L/VI:N/VA:H) appear conservative for a full Sysadmin escalation, and may not fully capture the confidentiality and integrity implications of gaining system-wide administrative access; this discrepancy is noted and my independent assessment differs (see assessed_cvss_vector). No KEV listing exists, meaning active exploitation is not confirmed by CISA. However, a public POC from Project Black is confirmed available, which meaningfully shortens the exploitation timeline for threat actors targeting LiquidFiles deployments. Real-world risk is highest in multi-tenant or enterprise environments where secondary domain Admin accounts are delegated to third parties or less-trusted users. Single-domain deployments are not exposed to this specific attack path.

An attacker holding valid Admin credentials for a secondary domain - whether through credential theft, insider access, or social engineering - authenticates to the LiquidFiles web interface and uses the group management feature to modify their managed secondary domain group in a way that triggers the broken authorization check, elevating their session to Sysadmin. With Sysadmin access, the attacker gains unrestricted access to all files, users, and system configuration across every domain. A public proof-of-concept demonstrating this technique is available at https://projectblack.io/blog/liquidfiles-privilege-escalation/.