CVE-2026-62992
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Smarty is a template engine for PHP. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a trusted directory could point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. Fixed in versions 5.8.2 and 4.5.7.
Risk Assessment
The risk includes the ability to read arbitrary local files, potentially leading to disclosure of sensitive data. This could be used for further attacks, especially if the attacker can place files in trusted directories.
Recommendation
It is recommended to update Smarty to version 5.8.2 or 4.5.7 (or later) and to restrict the ability to place files in template and config directories to trusted users. Also, regularly check directories for unexpected symbolic links.
Other vulnerabilities in Smarty
See all- CVE-2026-82531High
Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where nocache_hash is not restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply data with a forged SmartyNocache marker that is copied into the PHP cache file, enabling arbitrary PHP execution.
- CVE-2014-8350High
Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code, as demonstrated by "{literal}<{/literal}script language=php>" in a template.
- CVE-2026-62993Medium
Smarty is a template engine for PHP. Prior to 4.5.7 and 5.8.2, the {fetch} handling used Security::isTrustedUri() to validate only the initial remote URL, and PHP followed HTTP redirects by default. An attacker with an open redirect on a trusted host could redirect the request to an internal endpoint, bypassing the trusted_uri allowlist and performing SSRF.
- CVE-2026-62996Medium
Smarty is a template engine for PHP. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a php://filter-wrapped resource name to read arbitrary local files accessible to the PHP process. An attacker able to author or influence a template's resource reference could exploit this to disclose sensitive file contents. Fixed in version 5.8.4.
- CVE-2026-50745Medium
A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input to be reflected without escaping.
Original NVD description (English source)
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a directory Smarty treats as trusted (e.g., a template or config directory) could use it to point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. This issue is fixed in versions 5.8.2 and 4.5.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS