CVE-2026-62996
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Smarty is a template engine for PHP. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a php://filter-wrapped resource name to read arbitrary local files accessible to the PHP process. An attacker able to author or influence a template's resource reference could exploit this to disclose sensitive file contents. Fixed in version 5.8.4.
Risk Assessment
The risk includes the ability to read arbitrary local files, potentially leading to disclosure of sensitive data such as passwords, keys, or configurations. This could be used for further attacks.
Recommendation
It is recommended to update Smarty to version 5.8.4 or later and to restrict template authoring to trusted sources. Also, regularly review templates for suspicious references.
Original NVD description (English source)
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a php://filter-wrapped resource name to be used to read the contents of arbitrary local files accessible to the PHP process. An attacker able to author or influence a template's resource reference could exploit this to disclose sensitive file contents outside the intended template/config scope. This issue is fixed in version 5.8.4.