Is there a patch available for CVE-2026-62992?

Yes, a patch is available for CVE-2026-62992. Update the affected software to the latest version immediately.

Smarty CVE-2026-62992

Q: What is the CVSS score of CVE-2026-62992?

CVE-2026-62992 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-54498 MEDIUM

Path Traversal (CWE-22)

2026-08-07 GitHub_M

GHSA-f6wf-28g6-769x

PHP Path Traversal Smarty Smarty Php

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.4 MEDIUM

High complexity (AC:H) because a specific deployment overlap between upload paths and trusted template directories is required; PR:H and C:H match the official assessment.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 07, 2026 - 16:02 EUVD

Source Code Evidence Fetched

Aug 07, 2026 - 15:51 vuln.today

Analysis Generated

Aug 07, 2026 - 15:51 vuln.today

DescriptionCVE.org

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a directory Smarty treats as trusted (e.g., a template or config directory) could use it to point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. This issue is fixed in versions 5.8.2 and 4.5.7.

AnalysisAI

Symlink-based path traversal in Smarty's Security::_checkDir() allows an attacker who can place a symbolic link inside a trusted directory (such as a template or upload path) to read arbitrary files accessible to the PHP process, bypassing the configured secure_dir sandbox entirely. Affected are Smarty 5.x versions prior to 5.8.2 and all 4.x releases prior to 4.5.7, when Smarty's Security policy is enabled. The root cause is that _checkDir() resolves paths via string normalization only, while the underlying file_get_contents() call faithfully follows symlinks to their targets outside the sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Smarty (cpe:2.3:a:smarty-php:smarty:*:*:*:*:*:*:*:*) is a PHP template engine that exposes {include} and {fetch} directives for reading local files. When its Security policy is active, Security::_checkDir() gates every file-read by verifying the requested path falls within a configured set of secure_dir or template directories. The flaw (CWE-22, Path Traversal) is that _checkDir() canonicalized paths using Smarty::_realpath(), a custom method that only normalizes dot-segments and separators as a string operation - it never calls the native PHP realpath() and therefore never resolves symbolic links to their on-disk targets. Because the subsequent file read (file_get_contents()) does follow symlinks, a symlink placed inside a trusted directory passed the trust check while pointing outside the sandbox. The fix in commits 99c048c and a1ccdb0 replaces the string-only normalization with native realpath() for files that exist on disk, and also canonicalizes trusted-directory entries the same way, preserving legitimate deployment symlinks such as Capistrano current or macOS /var → /private/var.

RemediationAI

The primary fix is to upgrade to Smarty 5.8.2 (5.x users) or Smarty 4.5.7 (4.x users); both releases are available via Composer (composer update smarty/smarty) and as tagged GitHub releases at https://github.com/smarty-php/smarty/releases/tag/v5.8.2 and https://github.com/smarty-php/smarty/releases/tag/v4.5.7. For deployments that cannot patch immediately, the recommended workaround per the GHSA advisory (https://github.com/smarty-php/smarty/security/advisories/GHSA-f6wf-28g6-769x) is to ensure that no untrusted process or user can create files or symlinks within any directory listed in secure_dir or the configured template directories - concretely, restrict filesystem write permissions on those directories to the application's own deployment user only and remove any user-upload paths from the set of Smarty-trusted directories. The trade-off of the workaround is operational complexity: it may require restructuring upload handling so that user-writable paths are fully separate from Smarty-trusted paths.