Threat database

Smarty versions before 4.5.8 and 5.x before 5.8.5 contain a code injection vulnerability due to improper handling of the nocache_hash during multi-component template inheritance. This flaw allows attackers to inject arbitrary PHP code via crafted assigned data, leading to remote code execution when the PHP cache file is included.

CVE-2026-62993 is a Server-Side Request Forgery (SSRF) vulnerability in the Smarty PHP template engine affecting versions prior to 4.5.7 and 5.8.2. The issue arises from improper validation of URLs in the {fetch} function, allowing an attacker to bypass trusted URI checks via open redirects on trusted hosts. This can lead to SSRF attacks where internal endpoints are accessed by the server. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. It is fixed in Smarty versions 4.5.7 and 5.8.2.

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a php://filter-wrapped resource name to be used to read the contents of arbitrary local files accessible to the PHP process. An attacker able to author or influence a template's resource reference could exploit this to disclose sensitive file contents outside the intended template/config scope. This issue is fixed in version 5.8.4.

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a directory Smarty treats as trusted (e.g., a template or config directory) could use it to point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. This issue is fixed in versions 5.8.2 and 4.5.7.

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability.

EPSS 0.5%Vulnerabilitysmarty-php#cwe-94Germany+6

Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user. Users are advised to upgrade to either version 3.1.48 or to 4.3.1 to resolve this issue. There are no known workarounds for this vulnerability.

EPSS 1.0%Vulnerabilitysmarty-php#cwe-79Germany+7