CVE-2026-62992
MediumCVSS 6.9Summary
Smarty is a template engine for PHP. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a trusted directory could point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. Fixed in versions 5.8.2 and 4.5.7.
Risk Assessment
The risk includes the ability to read arbitrary local files, potentially leading to disclosure of sensitive data. This could be used for further attacks, especially if the attacker can place files in trusted directories.
Recommendation
It is recommended to update Smarty to version 5.8.2 or 4.5.7 (or later) and to restrict the ability to place files in template and config directories to trusted users. Also, regularly check directories for unexpected symbolic links.
Original NVD description (English source)
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a directory Smarty treats as trusted (e.g., a template or config directory) could use it to point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. This issue is fixed in versions 5.8.2 and 4.5.7.