Smarty CVE-2023-41661

Smarty before 3.1.21 allows remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as de

Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insuff

Smarty PHP template engine versions 5.0.0 through 5.8.3 expose a security policy bypass allowing file disclosure via the

Smarty before 3.1.33-dev-4 allows attackers to bypass the trusted_dir protection mechanism via a file:./../ substring in

Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring. Rated crit

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Rate

Cross-site scripting (XSS) vulnerability in the smarty_function_html_options_optoutput function in distribution/libs/plu

Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode. Rated high

Server-side request forgery in Smarty's {fetch} template function (versions prior to 4.5.7 on the 4.x line and 5.8.2 on

Symlink-based path traversal in Smarty's Security::_checkDir() allows an attacker who can place a symbolic link inside a

Smarty is a template engine for PHP. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no au

Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) before 3.1.12 allows re