Smarty, a PHP template engine, improperly limits pathname access in its stream: resource-name handling from versions 5.0.0 through 5.8.3. This allows an attacker with the ability to author or influence template resource references to exploit php://filter wrappers to read arbitrary local files accessible by the PHP process. The vulnerability is classified as CWE-22 (Path Traversal). The flaw is resolved in Smarty version 5.8.4.

An attacker able to control or influence template resource references can disclose sensitive file contents outside the intended template or configuration scope. This can lead to exposure of sensitive information stored on the server accessible to the PHP process. No remote code execution or privilege escalation is indicated. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, and high impact on confidentiality.

Upgrade Smarty to version 5.8.4 or later, where this vulnerability is fixed. There is no indication of alternative mitigations or temporary workarounds. Users should apply the official fix to prevent exploitation.