Smarty versions before 5.8.2 and 4.5.7 contain a path traversal vulnerability (CWE-22, CWE-61) in the Security::_checkDir() function. The function fails to fully resolve symbolic links before verifying that a requested path is within a configured secure directory. An attacker able to place or reference a symbolic link inside a directory Smarty treats as trusted (such as template or config directories) can exploit this to access files outside the intended directory, potentially reading arbitrary files accessible to the PHP process. The vulnerability is addressed by fully resolving symbolic links in the affected function in versions 5.8.2 and 4.5.7.

An attacker with the ability to place or reference symbolic links in trusted Smarty directories can bypass directory containment checks and read arbitrary files accessible to the PHP process. This could lead to unauthorized disclosure of sensitive information. The CVSS 4.0 score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality.

Upgrade Smarty to version 5.8.2 or later, or 4.5.7 or later on the 4.x line, where the vulnerability is fixed by fully resolving symbolic links before directory validation. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in these versions.