Smarty, a PHP template engine, had a vulnerability (CVE-2026-62992) in its Security::_checkDir() function where symbolic links were not fully resolved before verifying that a requested path was within a secure directory. This improper limitation of pathname (CWE-22) could be exploited by an attacker able to place or reference a symlink inside a trusted directory, such as a template or config directory, to access files outside the intended directory. This vulnerability affects Smarty versions prior to 4.5.7 on the 4.x line and prior to 5.8.2 on the 5.x line. The vulnerability has a CVSS 4.0 score of 6.9 (medium severity) and does not require user interaction or elevated privileges beyond high-level privileges. The issue is resolved in versions 4.5.7 and 5.8.2.

An attacker with the ability to place or reference symbolic links in directories trusted by Smarty can bypass directory containment checks and read arbitrary files accessible to the PHP process. This could lead to unauthorized disclosure of sensitive information. The vulnerability requires the attacker to have high privileges to place or reference symlinks in trusted directories. There is no indication of active exploitation in the wild.

Upgrade Smarty to version 5.8.2 or later, or 4.5.7 or later on the 4.x line, where this vulnerability is fixed. No other official remediation or temporary fix is documented. Patch status is confirmed by the vendor advisory indicating fixed versions.