CVE-2024-35226VulnerabilityPublished 28 May 2024Updated 3 Nov 2025

CVE-2024-35226: smarty · Code Injection

Affects smartySource CVE Database V5

Not known to be exploited · CVSS 7.3 High.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

7.3High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.5% chance of exploitation in 30 days – higher than 43% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 28 May 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

1. Upgrade Smarty to the latest patched versions: For v4 and v5 branches, update to versions >=4.5.3 and >=5.1.1 respectively as soon as they become available. 2. For users on the unsupported v3 branch, consider migrating to a supported version promptly since no patches exist. 3. Restrict template author privileges strictly to trusted personnel only; avoid allowing untrusted or external contributors to upload or modify templates. 4. Implement rigorous input validation and sanitization on template filenames and any user-supplied data used in templates to prevent injection of malicious code. 5. Employ runtime application self-protection (RASP) or web application firewalls (WAFs) with custom rules to detect and block suspicious template-related requests. 6. Conduct code reviews and security audits of templates before deployment to identify potential injection vectors. 7. Monitor logs for unusual template loading or execution patterns that could indicate exploitation attempts. 8. Isolate web application environments to limit the impact of potential code execution. 9. Educate developers and template authors about secure template practices and the risks of code injection.

Description

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.

Impact

For European organizations, the impact of CVE-2024-35226 can be severe, particularly for those relying on Smarty in web applications that allow multiple template authors or third-party template contributions. Successful exploitation can lead to arbitrary PHP code execution, enabling attackers to access sensitive data, modify application behavior, or pivot to further internal network compromise. Confidentiality is at high risk as attackers can read sensitive configuration files or databases. Integrity is also highly impacted since attackers can alter application logic or data. Although availability impact is not directly indicated, secondary effects such as data corruption or service disruption could occur. Organizations in sectors with high web presence such as finance, e-commerce, government, and media are especially vulnerable. The lack of patches for older versions means legacy systems remain exposed, increasing the attack surface. Given the widespread use of PHP and Smarty in Europe, the threat could affect a broad range of enterprises and public sector entities.

Summary

CVE-2024-35226 is a code injection vulnerability classified under CWE-94 affecting the Smarty PHP template engine, a widely used tool that separates presentation logic from application logic. The vulnerability arises from improper control over the generation of code via the extends-tag in templates. Specifically, a malicious template author can craft a filename for the extends-tag that includes PHP code, which Smarty then executes, leading to arbitrary code execution within the context of the web server. This flaw affects Smarty versions from 3.0.0 up to but not including 4.5.3, and versions from 5.0.0 up to but not including 5.1.1. The vulnerability requires at least limited privileges (template author role) and user interaction to exploit, but once exploited, it can compromise confidentiality and integrity of the application and underlying system. The CVSS v3.1 score is 7.3, reflecting high severity due to network attack vector, low attack complexity, required privileges, and user interaction. No known exploits are currently observed in the wild, but the risk remains significant given the potential impact and lack of mitigations for older branches.

CWE-94Improper Control of Generation of Code ('Code Injection') (opens in a new tab)
Base weaknessLikelihood of exploit: MediumCWE Top 25 (2025): #10OWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Architecture and Design · Refactoring
Refactor your program so that you do not have to dynamically generate code.
Architecture and Design
Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
OWASP Cheat Sheets
Server Side Request Forgery Prevention (opens in a new tab)
Unvalidated Redirects and Forwards (opens in a new tab)
Cross Site Scripting Prevention (opens in a new tab)
DOM based XSS Prevention (opens in a new tab)
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V5.2.8 (opens in a new tab)
V5.2.5 (opens in a new tab)
V1.5.1 (opens in a new tab)
Attack patterns
Leverage Executable Code in Non-Executable Files (opens in a new tab)
Manipulating User-Controlled Variables (opens in a new tab)
Code Injection (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 4 Nov 2025, 00:02 UTC

WeaknessesCWE-94

Technical details

References

Community reviews

Related threats