CVE-2026-62993: CWE-918: Server-Side Request Forgery (SSRF) in smarty-php smarty

Smarty's {fetch} function in versions before 4.5.7 and 5.8.2 uses Security::isTrustedUri() to validate only the initial URL when a security policy is active. However, PHP's file_get_contents() follows HTTP redirects by default, which allows an attacker who can influence the fetch target and exploit an open redirect on a trusted host to redirect the request to an attacker-controlled internal endpoint. This bypasses the trusted URI allowlist and results in a server-side request forgery (CWE-918). The vulnerability is addressed by updating to Smarty 4.5.7 or 5.8.2.

An attacker able to control or influence the fetch target in Smarty can exploit an open redirect on a trusted host to perform SSRF attacks, potentially accessing internal network resources that should be protected by the trusted URI allowlist. This could lead to unauthorized internal resource access or information disclosure. The CVSS 4.0 base score is 6.9 (medium severity).

This vulnerability is fixed in Smarty versions 4.5.7 and 5.8.2. Users should upgrade to these versions or later to remediate the issue. No other official remediation or temporary fixes are documented. Patch status is confirmed by the vendor advisory embedded in the description.